The Complete Zcash Roadmap | Sean Bowe and Dev Ojha

0:00 Every time Zcash made a technical decision, the rest of the industry copied it. This was namely Ethereum. When you use a transparent ledger now, you should be actually really nervous. Do you have better anonymity in a system that has a thousand payments per second or one payment a week? Obviously a thousand payments per second.

0:16 There's a difference between something being like 99.9% private and 100% private. We don't want to bend the knee on the privacy stuff. It would compromise our values. What parts of Zcash are still quantum vulnerable today? And what's the plan for fixing it? There were three big pillars of this. The first one is quantum recoverability.

0:36 There's this element of the tachyon privacy design that was shippable today for Near Intense. It's now shipped today in some of the wallets. Yeah, I don't know who the whales are because it's private. Privacy gives you a lot. You cannot fish someone's wallet without a viewing key so easily. It really matters what the Zekholders think.

0:53 Zekholders are the lifeblood of the project. Bankless Nation, I'm joined here with Sean Bowe and Dave Oja. Sean is a Zcash co-founder. He's been working in Zcash since 2015 and is the lead developer at Tachyon, which is an effort to overhaul how Zcash works, something we'll get into shortly. Sean, welcome to Bankless.

1:14 Yeah, thanks for having me. It's awesome. Dev is a longtime ZK researcher, co-founded Osmosis, the biggest DEX in the Cosmos ecosystem that works on Zcash, trying to scale private transactions and quantum resistance, also something that we'll get into shortly. Dave, welcome to Bankless. Thanks for having me.

1:29 You two have come recommended to me as two of the smartest people in crypto who have both gotten nerd sniped by Zcash. So maybe let's talk, let's start there. Why work on Zcash? Why is Zcash important to you? Sean, maybe I'll just start with you. Well, I've, yeah, I guess I was nerd sniped like a decade ago.

1:47 So I've been working on Zcash since the beginning. I was like a huge Bitcoin guy in my teenage years. And I always knew that Bitcoin had major privacy flaws that were going to be eventually fixed with cryptography. And so I wanted to make that a reality in Bitcoin and then gradually saw that that was never going to happen in Bitcoin.

2:11 And then when a lot of interesting new cryptography papers came out, which actually made it possible for this to happen in blockchains in general, I was really excited about it. I was kind of waiting for it. And I got accidentally, accidentally got a job working on Zcash. So I was really lucky. And so...

2:31 I guess in the beginning of my obsession was with the cryptography and I also have like a philosophical attachment to privacy, uh, like a moral attachment to it. It, uh, so that's important to me. So over the years it's been fascinating that the cryptography has remained really interesting. Uh, And despite the fact that in cryptography, like the fact that we can go a decade and there's still like new papers coming out every month or every couple of weeks that make things a little bit better or kind of surprise you a little bit is actually really exciting and awesome.

3:06 So I really like the math. But also just the project has become incredibly important for privacy for many years. It was the only real project in the entire blockchain world that was actually trying to do privacy and doing it at a great personal risk for some of our developers. There's always this crushing threat of regulatory escalation and everything else.

3:31 And so the fact that we kind of persevered through that, And now we're doing really well. That's also really exciting and awesome. And we're growing as a project. People like Dave, for example, it's just it's a really exciting time for Zcash. Yeah, Dave, I'd love to hear from you as well about what motivates you to work on Zcash so strongly.

3:56 Again, like I said, you guys have come highly recommended to me as people who are relentlessly mission driven and zeroed in, locked in on Zcash and privacy. So Dave, what motivates you so hard? Yeah, I actually joined, what got me into cryptocurrencies, like this is a space that's really worth assessing over, was first actually learning that, oh, we can have, well, I did my first like, you know, bank check.

4:22 I was like, what the fuck? If you just know these numbers, you can like strain my ballots. And then I was, and that's how I know cryptography. I'm like, we have this whole cryptography system. Oh, that's what Bitcoin's doing. Bitcoin's using digital signatures to go protect all this stuff. Well, okay, that's cool, except that you know my public identity.

4:40 That's kind of crazy. I deeply care about privacy. So once I learned what Zcash, I'm like, it's actually the first crypto coin I ever hold. Yeah. this matters for solving privacy for the world. Then I learn about proof of stake and all these other problems for how we make blockchains usable, like IBC and Cosmos land.

5:01 Like, okay, we need to have, in order for this to go anywhere, we need to start having chains be able to communicate, et cetera. Um... So I spent a lot of time doing Stark work with one of the Zcash scientists, Salisandro Keza, learned a ton from him, and then work on Tetherman to scale proof of stake and make cross-chain communication happen and possible.

5:22 It's like, I don't think stuff's going anywhere if you can't toggle cross-chains. There's not going to have one monolith that solves it all. Well, yeah. And fast forward a few years, it's kind of DeFi summer, and we realized that, hey, one of the big problems, we have three big problems in crypto in 2020-ish.

5:40 Scaling, proof of stake is mostly solved, solved, and privacy. So we found this chain that's actually trying to tackle privacy for MEV. And the initial roadmap and goalposts is actually quite like Penumbra of do private holding things and do threshold decryption to solve a bunch of like MV risk. And then, you know, things start getting carried away, gets caught up in DeFi land.

6:09 Turns out the whole privacy side roadmap was never really fulfilled on. But except that was the part that got me excited. That was like, well, I woke up every day to like work on the thing. Things then come last year. Okay, we're going to repivot everything to fully privacy early last year. And then there's this big problem.

6:30 How are you going to make a privacy system that scales and goes anywhere? And I've always followed and loved Zcash the whole time. First coin held. Friends of many people from the era of four or five years ago. And all the research. I ended up meeting Sean and it's like, oh, whoa, okay, this is considered an effort to make this win and make this succeed.

6:52 That's... Let's join forces and make it happen. So I think it's the best shot we have for privacy winning. Also, I was really inspired by every time... Every time Zcash made a technical decision, the rest of the industry copied it, even though when they're copying, if you're alert to what's going on, you'd obviously do something different.

7:13 So it's like, oh, okay, Zcash sets the way. This is namely Ethereum. When Ethereum was doing its first pairing stuff, Zcash had switched from one curve to Southern one called B12381. Who cares? When Ethereum was going to go do stuff, it should have obviously done 12377. Now, they didn't just because Zcash did it.

7:32 Oh, it's kind of inspiring. Yeah. Then you suddenly see a bunch of people start saying they care about privacy, who I was on calls about six months ago pitching stuff like, well, we're doing it. No, no one cares. No one, this will never matter. I was like, oh, wow. Okay, so Zcash succeeding is also inspiring for the rest of the world to care about privacy in a way that other things aren't.

7:53 Yeah, I don't think any Bankless listener is naive to why privacy is important. We've covered the topic of the importance of privacy a handful of times, probably primarily with Zuko, but a number of other guests. But I want to ask you guys about why privacy might be urgent. in 2026. Because if you asked me when I first got into crypto in 2017, we're like, oh, yeah, privacy is going to become a core pillar of the industry.

8:19 And we are all going to have financial privacy very quickly, soon after proof of stake. And not only did proof of stake not really come very quickly, but neither did privacy, with the exception of NZ Cash. So Sean, I'll ask you guys about this, but I'll start with you, Sean. Like, what's your case for why privacy is urgent these days?

8:39 Yeah, so, you know, it used to be that when you used a transparent blockchain ledger to transact, you know, if you're just a normal person, you weren't really worried about the fact that these, you know, chain analytics firms existed who could basically track everything that you do. Associate all your transactions together, figure out your online activity based on that, for example, because you weren't really a real target.

9:06 I was worried, but most normal people weren't. And hackers and thieves were... Because you're not normal people. Right. So hackers and thieves were... you know, always really nervous and careful about using these things. But now with AI, obviously, a teenager just with access to an LLM, basically, can identify and track everybody using these things.

9:35 So everyone using crypto. So when you use a transparent ledger now, even if you're not a thief or a hacker or a criminal or any of that, you should be actually really nervous. So in the coming years, I think it's going to get much worse. It's going to get so bad, in my view, that you will have these just public databases, these free public databases that have completely mined the blockchain of information.

10:08 where every single individual who's been transacting on public ledgers has been quantified and tracked in every possible way. And I think with this sort of AI resurgence, I think that's why privacy has like exploded. It didn't just like gradually get better. It kind of exploded over the last year. And that's why, because I think a lot of people paying attention actually realize that this is serious.

10:33 We need to get away from these transparent ledgers like right away. Yeah, the follow-up problem is it's not just, like, your blockchain transactions. It's also every other data leak that in the world compounds, like, each Coinbase transaction exchange leak. Oh, that's your address that gets tied to all this.

10:49 It's not just, like, your physical address. It's not just, like, there's one human in the world who has, you know, this much of a balance. So, yeah. I think the problem's always been bad. It's just not many people had friends at Chainalysis to see how bad it was. And now you don't need a friend. You just go type one sentence into Claude or just see the breach of the day to understand.

11:20 So in myself and also a lot of listeners probably are very familiar with Ethereum's like swim lane roadmap. I'm wondering if there's something like that as scaffolding for knowledge for understanding the rest of the Zcash roadmap, because that's really what I'm looking to understand here with you two, having the opportunity to talk with you guys.

11:41 how would you guys categorize the work left to do on Zcash? Like what are the broad categories that all the work kind of fits into? Well, I'd be curious to see how Dave would categorize it, but I would, I guess there's, in my mind, I think there's three camps or three like categories. There's the cryptography side.

12:02 So there's trying to make the cryptography more secure and more efficient. There's the... There's the kind of the consensus protocol. So the networking side of things, making that scale. And then there's the wallet side of stuff. So making wallet scale and giving them good UX. I think those are probably... And then Dave can speak to the last problem.

12:27 I think it's actually the most challenging problem. And he's actually... That's kind of why I'm really bullish on Zcash is because he's actually most likely to solve those problems. I kind of think of it in high-level goals of... Get scale, harden the chain, and then ensure full economic sustainability, where the latter is almost a minor detail, but I feel it's not one of the other two, actually.

12:57 Now, scale, in my head, encompasses several things, which is, this is maybe a user-facing map of, like, these are three properties to expect. But to hit scale, you need a ton of stuff for wallets. And then you need a ton of stuff in consensus, like make high throughput proof of work for the first time ever.

13:16 And you need cryptography advancements, like recursion and Tachyon, and all sorts of fee market updates, getting this into making an aggregated mempool, et cetera. Then the second one is hardening, is a bunch of privacy improvements, getting increasing security numbers, bits of numbers, post-quantum, do you go multi-assumption, formal verification, supply chain, etc.

13:46 And the last one is economics. Well, today there's a bunch of services that you expect people to run for you. If you take Ethereum or Solana Wallet, RPCs are paid for by the wallet, like by Phantom Company or MetaMask Company. And they do some stuff to ensure you're not like spamming a bajillion wallets.

14:08 And they expect to make money off you when you go swap one day. In Zcache, there's no tracking of the users. So then there's a couple of entities who provide these services for free for requesting data. It turns out that in order to make Zcache scale, those guys have to do a lot more work over time. So, But then we also don't want to have, you know, them able to track you.

14:34 Like, so we want to have a way for the user to pay the RPC providers, but break any sort of tracking link. So we need to build some sort of private subscription service so that, you know, we're not relying on altruism. Or what, you know, I think the most altruism is that, like, it ends up being a centralized foundation or nation states.

14:54 So we don't want that. So user has to pay properly to get a proper market and have no identities. You can spitball some answers for us, but there's a difference for, it hasn't actually been deployed and real. So as I'm kind of like learning about this, hearing you guys, a lot of this stuff feels very familiar to me.

15:11 Like we need to scale the chain. We need to get over the quantum hurdle. The thing that feels uniquely different about Zcash is the relationship with the Zcash protocol and the wallets that use Zcash for privacy. That doesn't seem like it has any corollary to Ethereum or Bitcoin or any other project that I'm familiar with.

15:30 because, and I think it's the privacy variable that really makes this true. Whereas if you want to use a wallet while also maintaining privacy, there's just some extra considerations that need to be made to preserve the notion of privacy. And that creates new engineering challenges that is unique to Zcash.

15:51 Is my understanding correct here? Yeah, absolutely. I put it in two buckets as well. scaling privacy for wallets is a fully unique challenge and actually it's actually harder than scaling a chain. And then scaling the... And then, yeah, how do you architect the chain to be more privacy aware? It's actually...

16:12 I think that's a little bit easier of the two. Like, actually, one of the brilliant things of Tachyon is early in Zcash, these are really coupled. A lot of the things you need to be private and make the wallets private and wallets standards is baked into the protocol. one of the cool things attacking was actually these get unbundled and it's a lot of like just I don't know how you frame it Sean but in my head it's like we got we learned how to make ZK way faster so we didn't have to bundle these things for the last 5% of efficiency yeah I think that we also bundled them for weird reasons like for example um addresses.

16:46 We early on in Zcash, we were, we wanted to, uh, address this to be as small as we could. And so, uh, certain keys that were in the addresses needed to be used both for the, the, the wallet facing side of the, uh, the stack. So for like the private transfers of information over the chain, and then the others just for the custody and, and, uh, spend authority stuff.

17:10 And, and so those got, uh, Those got merged together just to make these addresses small. But of course, now we live in the kind of post-quantum world where the addresses are going to get really large. And so we need to solve that problem anyway. So it's kind of just it turned out to be a pointless engineering architecture that we've learned from that.

17:33 So I want to drill down into each of these three different categories. Both of you gave me three categories. And while doing my best to make sure the layman can kind of, you two are both very technical. I'm trying to do my best to get technical answers out of you that are still accessible to the layman.

17:49 Before we start down those paths, those three different paths, Are there any overarching principles or philosophies that guide Zcash development broadly? Like something like in Bitcoin, for example, all Bitcoiners will say everything about Bitcoin is a means to an end to preserving 21 million units. That's an architectural philosophy that Bitcoiners have.

18:12 Is there anything, is there any lesson like that in Zcash? Sean, I know you've used this phrase, ledger indistinguishability before. Maybe that is something to talk about. But as developers who are writing code, and as all cypherpunks know, code is imbued with values. What philosophy can you share as just like lessons for me and the listeners about how Zcash is built?

18:35 Yeah. So definitely the one philosophy that I think is ingrained throughout Zcash, if you wanted to pick one, is kind of a maximalism on privacy. So in our shielded pools, we go as far as possible when it comes to privacy. And that's the thing that you were mentioning about ledger and distinguishability.

18:58 So... So ledgering distinguishability is basically this academic term. So it's just a way to, like, if you say that something's private, like, say blockchain transactions are private, what does it actually mean to say that? Like, ledgering distinguishability is a way to quantify or study that. So... the way cryptographers do that is they kind of create this game where your adversary is trying to distinguish two transactions from one another.

19:29 So they'll, you know, have a transaction from you and have one from Dave and want to tell them apart. And if they can, then it's, then it's game over. And so that's a, it's actually a really, really strong, really, property because it means that the transactions have to look like just random data basically in order to win that game.

19:48 So all this privacy tech that exists in every project, like stealth addresses and ring signatures and stuff like that throughout the crypto world, those can help in certain situations, but fail that game easily. And so... So we've kind of been really hardcore about making sure that like we've proven and now formally proven to some extent this these security properties like ledger and distinguishability for these shielded pools that are in Zcash.

20:26 Now, do we... Is it like a hard and fast rule for Zcash? No, because we have transparent addresses. And there's other kinds of considerations. And so we do, like... We take a practical approach to it. But... I guess the other part of that is that we also don't want to add any sort of concept of like a backdoor or any kind of like viewing capability for a regulator or any kind of anything like that.

20:56 A lot of projects that have dabbled in privacy over the years of 2020. like, uh, entertained these goofy little, um, entertained bending the knee. Yeah. Vending the knee. We, we don't want to bend the knee on, on the privacy, uh, stuff. Uh, we don't, we don't need to, we, it would compromise our, our, uh, our values.

21:16 And so we don't even, uh, we, yeah, we don't even entertain it. Yeah. Yeah, I think that's what a lot of people get excited about Zcash about. Going back to the first thing you said, with like the ledger indistinguishability and just a full commitment to privacy, just to illustrate that point a little bit more, there's like a difference.

21:37 I think what was something, another way to say what you were saying is like there's a difference between something being like, 99.9% private and 100% private. And if you go back and just look through the arms race between cryptography and cryptography breakers, like cipher, cryptanalysis, I believe is the word, is that all weaknesses of any sort of cipher ever is that it leaves traces.

22:05 It leaves a trace somewhere. And if you leave enough traces, then somebody can Sudoku puzzle their way back into breaking the cryptography and the arms race continues. So maybe, Sean, is maybe another way that what you're saying is that we're not going for 99% privacy. We're going for 100% privacy. Yeah, in cryptography, there's always these known unknowns and unknown unknowns when it comes to whether if you leak a couple bits here, you can kind of just...

22:31 and gesticulate, say, oh, well, whatever, it doesn't matter. We can't think of an attack. Cryptographers know better. They say, okay, well, that's probably going to come back and hunt us, even if we can't think of an attack now. But actually, when it comes to blockchain privacy, we actually know about all of the attacks or most of the attacks that you can perform if you only have this really good privacy, but not 100%.

22:55 Like there are these attacks, for example, called set intersection attacks, where if you're trying to identify the source of money and you have somebody using a protocol which anonymizes them amongst a large group of people, even a very large group of people in each transaction, then all you need is two transactions from your target in order to very quickly eliminate anyone except the actual target as being the source of those transactions.

23:28 Simply because you leak way too, leaking anything at all in one of the transactions immediately breaks everything in the other one. And we've known about this for a long time. Cryptographers have known about this. In fact, like this notion of ledger and distinguishability, um, comes from like, I don't know, 12 years ago or something like that.

23:51 In the zero cash paper, zero coin paper, whatever it came from, where they were actually trying to be more rigorous about what does it actually mean for an adversary to be able to break your privacy. You needed that. in order to actually eliminate these kinds of set intersection attacks and stuff. So we actually know about the problems that are going to come back to haunt us.

24:12 Most of them, not all of them. And knowing about them is the first step, I think, to just pruning them away from Zcash, which is what your job is, Sean, right? Yeah. Dave, anything to add about the philosophy behind Zcash? Yeah, maybe I just restate a little bit simply of... Yeah, please do. ...maximize privacy of don't take a shortcut.

24:31 And so on the chain side, you went for the best known, the best you can get since day one. And now the principles only expand it further and further where, hey, it turned out the RPC side was always hard. So now we're bringing in solutions to keep improving that. So don't settle for any known distinguisher I think one pre-core one.

24:55 Another one is we inherit a bunch from Bitcoin. 21 million hard cap that shouldn't change. Proof of work. Is proof of work built into the Zcash culture? Yeah, so there were some moves to push back and change it or add more to it. I think it's pretty solidified that the proof of work for the block awards is pretty central.

25:19 I haven't seen any, and if you want to change it, you'd have to get miners on board and like coin holders on board. Interesting. That's something that will go into the long-term security plan for Zcash towards the end. Let's get into scale. Let's go into this first swim lane scale and Tachyon. First, just again at a high level, why is it important to scale Zcash at all?

25:39 Why can't it just be like Bitcoin, which is to be a very decentralized, slow, constrained blockchain? Why doesn't that work, Sean? We need it to scale because, so like Bitcoin succeeded over the years because it got institutionally ingrained. Because millions of people started using it and... You know, it would upset a lot of people if you did something to harm it.

26:02 So it was sort of a foregone conclusion. We want Zcash, I think, I want Zcash to end up in that same position where just like as many people hold it as possible and use it as possible so that it becomes ingrained like this and becomes harder to attack. And so that's one reason. I mean, there's many reasons, but...

26:25 it needs to scale the payment, the private payments need to scale in order to make that work at all. Otherwise people would just use some other tech. And that's really the simple answer for me. Uh, it's not going to succeed if people can't use it to transact. If people were just going to use it to, to hold it, they could do the, they could do something like that with Bitcoin.

26:47 Uh, Another way to think about it is like, do you have better anonymity in a system that has a thousand payments per second or one payment a week? Obviously a thousand payments per second. And so the limiting principle is, yeah, go get this to be as usable as cash. So there's a one-two punch that I'm seeing here is that A, the job of being private is easier if more people are using it.

27:11 The anonymity set there is larger. But also inside of Zcash philosophy, it's not just good enough to be a private store of value. It must also be a private way to do commerce too. One of the most inspiring moments I had when meeting a lot of the Zcash team members for the last 10 years is we meet folks in some city.

27:30 There's this dinner bill and a split of 11 people. And we have some very incredible people trying to split this by hand and calculate taxes or whatever. But then it was a bit silly. But then it was perfect peer-to-peer splitting using ZEC payments to each other or ZEC OTCs to USD to pay. Because there can be no credit card used and you have to use ZEC with the ZEC wallets.

27:54 But it was awesome. I've been going to crypto events, I don't know, 10 years now. I've never seen people actually split up payments and using the real wallets. at an event. Using this as like currency is actually in the culture. Just kind of awesome. That is cool. That is cool. And going into just like the human rights and individual rights like element.

28:19 To me, this is like kind of encoding, hard coding in cryptography. The right to assembly. if you will, because of these 11 people with this payment, had you guys used credit cards, some authoritarian nation state could have said, like, oh, look, you guys assembled. These 11 people assembled, and in this dark authoritarian imaginary world that I'm creating, that's not allowed.

28:40 according to this oppressive nation state. And so removing the traces of data of people coordinating with each other and grouping with each other, that's the practical application here. Let's get into Tachyon, which I think is the first step into the world of scale for scaling Zcash. Sean, how do you explain simply Tachyon, what it does and how it scales Zcash?

29:08 So over the years, Zcash has had these different shielded pools. And like every few years, we've added a new one. And they've always... like tried to improve something like the efficiency or, or add features or whatever people, people kind of gravitate toward the most recent pool. Um, like the most recent one was Ironwood, which we launched earlier this year.

29:33 And the reason to gravitate toward that is that it was formally verified. Um, the one before that orchard, was created because we wanted to remove the trusted setup, so we made it more secure in that sense. The one before that was Sapling, which we made because the Xero Knowledge Proofs that we originally shipped in Zcash were really, really slow, and you couldn't even use it on phones, and so we needed to use, like, bleeding-edge ZK tech in order to make it possible.

30:03 So we've been making these incremental advances in the cryptography, and that's what Tachyon is. basically we're tackling the last areas where the cryptography holds scale back. And there's a couple places where it does this. So the first place is that proofs are large. And so if you want to put them in transactions, if you want to put more shielded transactions in a block, you have to deal with these zero-knowledge proofs.

30:36 You have to aggregate them. So like in Bitcoin today, we're having all these conversations about scaling Bitcoin in a post-quantum world where you have post-quantum signatures that are much larger. So you have to think, not just in Bitcoin, but in like Ethereum and everything else. So we're thinking, how do we aggregate these signatures together or these objects together so that we can actually strip them out of the transaction and replace them with like a bigger one per block Um, that's basically what we're doing, except we have that problem.

31:08 We have that scale problem already, even in the pre-quantum world, um, where, uh, and it applies to our zero knowledge proofs, not signatures, but zero knowledge proofs. Um, and so Tachyon kind of addresses that and it uses, uh, this thing called a recursive snark to do it, um, which is this like fancy cryptography.

31:29 Um. And there's this other technical thing that doesn't scale very well in Zcash today, where basically every transaction that takes place, every shielded transaction, adds or grows this set called the nullifier set. It grows it perpetually and you can't get rid of any of the data in it because you need it to prevent double spending.

31:53 Is this state bloat in the Ethereum world? This is state bloat? Yeah, so this is state bloat. Like in Bitcoin or Ethereum or whatever, you don't really have this problem because you can go back through and just remove the old data. I mean, you can keep the old chain data as like an archive node, of course.

32:14 But the data you need to actually validate new transactions is... only has to sort of scale linearly with the number of users you have, usually something like that, uh, in, in most transparent blockchains, but in ones like ours that take the privacy seriously, you're, you're basically screwed a little bit.

32:34 Uh, you need, you need to set that grows perpetually and Tachyon addresses that also with the recursive snarks. So we also use this cryptography to sort of compress these things. And, and, and, and, We're basically tackling these two parts of the scale problem for the cryptography so that the remaining scaling challenges that exist in Zcash are, I don't want to say just engineering challenges because they're really, really daunting engineering challenges, but it becomes like the lower layer of Zcash, the cryptography is out of the way.

33:09 So we don't have to worry about that part of the architecture anymore. Everything above it needs to solve. The scaling challenges need to be solved above that, like on the consensus protocol or at the wallet user-facing side of things. And that's sort of the direction that we're going with Tachyon. Of the part of Zcash that Tachyon addresses, this isn't like block speeds or block sizes, which is like kind of the traditional thing to talk about when we talk about scaling.

33:41 This is talking about reducing the size and therefore increasing the scale of the shielded transactions part of Zcash. Is that correct? The actual cryptography, the private payment cryptography that takes place on-chain, just falls apart with too many transactions, quite frankly. And so we need to fix that so that we can talk about, you know... Increasing TPS.

34:04 Massive blocks and massive TPS. Yeah, it's not even a conversation until we address those problems. Right, yeah. So the goal is high TPS, high big blocks. First, we need to solve some dominoes earlier in the stack that allows us to have the resources to do the high TPS thing. Yeah, tagging on its own is a scale upgrade.

34:29 It changes the equation if you're a full node of today. Let's say you want to process a million transactions in a block. You have to go and verify a million ZKPs. With Tachyon, your job as a full node is now to verify one ZKP. That's pretty cool. Second is that, oh, a million transactions would cause a million units of state forever.

34:50 Okay, the state is now gone with Tachyon. Now it's literally, if people are familiar with, like, a lot of the 2017, 2020 discussions of stateless blockchains, Zcash is like, achieve what they're all talking about with the stateless blockchain. You've got some state for the last... like month or so in a live full node, then everything else is like this historic state that you can trustlessly query, need to go use, but it's not in the full node itself.

35:18 So Tachyon brings both of these and the first one is already like a 5X plus scale improvement like on day one. This is starting to remind me of like just ZK, ZK rollups in Ethereum land. You have a bunch of transactions, you roll them up once with a ZK circuit, and then you roll it up again with another ZK circuit and you post the proof to the Ethereum layer one in the blob space.

35:41 It sounds, the pattern sounds pretty similar. Is that about right? Yeah. Yeah, credit to Ethereum for doing a bunch on pioneering deployment of recursive CKPs. It's the same thing. The same thing is going on for the first part. And the second part of going stateless is like a net new for the first time ever thing that Sean came up with.

36:01 Yeah, so there was this paper that I wrote with Ian Myers last year where we detailed this technique that I don't want to take all the credit for it, but where we detailed this technique that's kind of novel where you that allows you to combine the recursive proofs with this other trick to make it possible to do so.

36:22 And then also with statelessness and just reducing the size of bloat, minimizing, eliminating the size of bloat on the ZK blockchain, doesn't that just also make it, the blockchain itself just more permeable across the internet in the sense that smaller devices can manage and take part in the ZK, in the Zcash blockchain, is that right?

36:41 Yeah, this depends what's your goal on, are you building a blockchain where you want a Raspberry Pi to be a full node? I think the Solana folks were actually entirely correct on this side of the trade-off. If you want a Raspberry Pi, you're not getting scale. You're not going to be, in Solana's case, you're not going to be a decentralized NASDAQ.

37:02 That doesn't make any sense. In Zcash's case, no, you can't shove 50k TPS to a Raspberry Pi, even if you want it. Because at some limit, there is like a bandwidth problem. Like how much can you process in a Raspberry Pi? 10 megs, 100 megs, et cetera. But it does drop the requirement of, okay, maybe you don't need a petabyte of SSD.

37:25 You just need a couple hundred megs, a couple hundred gigs of SSD. So Zcash isn't on the side of the spectrum of Raspberry Pi full nodes. I think everyone's on board with like, look, you want to be a payment system, that's not going to work. But okay, let's do a bunch to maximize it under being reasonable.

37:44 Dollar stablecoins taught Latin America how to store value on-chain. Ripio is taking that same idea and bringing it to the currencies people actually use every day. With wrapped fiat, Ripio is putting more than a decade of experience powering crypto infrastructure for leading companies across Latin America behind a suite of six local currency stablecoins covering Argentina, Brazil, Mexico, Colombia, Chile, and Peru.

38:05 Each is pegged one-to-one to its local currency and fully backed by reserves held in regulated financial institutions with independent attestations published for each token. But wrapped fiat is not just designed to sit there, it's built to move. The suite is live across 10 EVM chains with liquidity and integrations already spanning platforms like Morpho, Uniswap, and Chainlink.

38:23 users can move between local payment rails like PIX and SPAY and matching wrapped fiat one to one in real time with zero fees on both on ramps and off ramps and no FX conversion local rails in on chain in the middle and for builders, Ripio offers APIs, web hooks, widgets and a sandbox just from day one start building with wrapped fiat today at platform.rippio.com your checking account isn't public so why should your crypto be?

38:46 as AI gets more powerful, your privacy gets weaker Connecting your identity to your financial history on chain or off is the easiest it's ever been and will only get easier from here. Every data breach adds another piece to the puzzle and every public transaction leaves a trail back to you. And when your wealth is visible, you become a target.

39:04 Money that can be seen can be stolen. Being in control of your money should include controlling who sees what you do with it. Zcash fixes this. Zcash is private digital money with privacy enforced by zero-knowledge cryptography. Zcash-yielded transactions let you send and spend without publicly revealing who you're paying or how much.

39:21 When it comes to privacy, there is no second best. Get started with Zcash using Visor, the wallet Zcash devs and enthusiasts use to encrypt their money. Zcash wallets are non-trivial, and Visor goes the extra mile to make sure your money and privacy are fully protected. Open source, self-custodial, fully private.

39:37 Use the link in the show notes to download Visor on mobile or desktop. Protect your future. Use Zcash. Is the Tachyon conversation the entire conversation around scaling around Zcash? Or what else is there that's not included in Tachyon with how to scale a blockchain? So Tachyon changes the cryptography side to make the scaling equation.

39:57 As far as the blockchain is concerned, hey, every transaction is two kilobytes. Okay, you want 50,000 transactions per second? Go build me a blockchain with 100 megabytes of census throughput. So then you have one whole new branch of how do you build a blockchain under proof of work that can achieve 100 megabytes per second of throughput.

40:20 Then you have a second part of the equation, which is unique to privacy, which is how do you build a private wallet that can discover when it gets paid without downloading all data on the blockchain? I think what people, people often spend a lot of energy in trying to understand Zcash on how the zero-knowledge proof works, which is really cool.

40:44 But the second question I think that people should understand, which is why has Zcash UX taken as long as it has to deliver or be usable, is the hard problem is how do you figure out you got paid? An anonymous payment is one where no one knows who it's from, who it's to, or how much is in it. So then...

41:06 How can your wallet can't go ask a server, hey, what's my balance? Right, because it's a private blockchain. How does a wallet know if the blockchain is private? So the solution that's been done in Zcash up until very recently is you're going to go download every single transaction history and test, was this a transaction, a payment to me?

41:28 Yes, no. But that can't scale. Because if the blockchain is doing 100 megs a second, you'd have to go download 100 megs a second. That doesn't work. So... there's this really cool new line of cryptography that basically had a breakthrough 2024-ish. Sorry, 2022-ish. But it's only really usable now. Oh, called Prime Information Retrieval.

41:58 And it's this huge work to say, to call it, To say instead of phone, go download a terabyte of data. Instead, go do a query to a server. The server will operate over a terabyte of data and give you back an answer, but the server won't learn anything. This should feel a bit like FHE. Somehow I can encrypt some data, go talk to a server, or the server does some stuff on the data, gives me back an answer, and the answer is useful for me.

42:33 And I feel like FHE because it literally uses homework under the hood. Because it is FHE. Yes. So it turns out for this precise use case, there were breakthroughs and tricks that makes it very fast to do on a server. It turns out you can transform this problem into just a big matrix vector multiplication.

42:56 And it turns out that, hey, our friends in the AI world have made big matrix vector multiplications very cheap and usable for us. Go have someone buy an H100 and go service for all of us. So these two things have come together and the cryptography side invented this. And AI land has really optimized GPUs to make this a viable world.

43:21 And so that's where we're going with the wallet side to make that scale. And Zcash has already deployed this PIR stuff. Like we just had a coin holder vote where we used it for the first time, I think, in any cryptocurrency project has ever used PIR. We used it less than a couple of months ago. How does this not introduce a centralized third party, however?

43:45 If we are querying a server... Okay, I get that with FHE and the advancements in GPUs and processing power and all of that stuff, that I will be able to remain anonymous because that's what the math does. It keeps me anonymous. But nonetheless, I'm querying a centralized server. And so how does that not turn into a trusted intermediary that kind of arbitrates my relationship to Zcash?

44:09 So there's two parts. One is kind of like RPCs, where take Ethereum, right? You have to go talk to one RPC provider. Now, it's permissionless to go make a new RPC provider. Just go download a new copy of the chain and go index it yourself. And there's multiple providers already there. There's Alchemies, there's Infuras, et cetera.

44:31 Apologies to all the other dozen plus providers. The ones that you're missing, yeah, sure. Yeah. But there's a lot of options. So same thing as eCache, there'll be a ton of options. And there should be a market incentive where you can pay the providers you have anonymously. So you can anonymously pay the providers so that you can access it.

44:53 And if there's, for some reason, you're being disenfranchised, whatever, there's not a reachable one. Okay, go spin up a new node to the blockchain with, admittedly, a lot of bandwidth capacity. Sync it up and start serving. Okay, okay. I would suppose that the paying of the Alchemy, the Inferia, the RPC provider is also a privacy engineering challenge that is somewhat difficult, but you, I would assume, thinks it's overcomable.

45:20 Yeah, I can even sketch how you overcome it. Sure. And the verbal sketch is basically, okay, in Zcash, we've got this trick for preventing double spends. If I want to go pay an RPC provider, I basically need to prove to you that when I go do a query, hey, I've got an active subscription to you, and my subscription has given me, let's call it, 10 requests per second.

45:48 And then, hey, look, I'm not using more than my 10 requests per second. So what I could do is I can make 10 one-time tokens for every different second. And then, or maybe let's be more practical. Let's say I get 1,000 requests a month. So I can make a thousand different one-time tokens. Every time I do a payment to you, I use the same technology I use for my private payments for proving no double spend to prove, hey, I'm burning a new token each time.

46:20 And it's a valid token that you, the server, have authorized. Now, you, the server, don't know which of your million users is using the subscription, but you can authenticate that, hey, it's a real subscription. The engineering problems, there's two engineering problems. One is how you do this for the first time if you're onboarding a user.

46:39 Like, if I'm giving you your first sec, well... Okay, you've got a wallet. You've got to go pay the wallet. So am I the one paying for your subscription? This looks a little... You can imagine a world that looks a little bit like Solana's state rent, if you're familiar or not, which is that every unit of state you have requires a minimum solo balance.

47:00 You don't get deducted, but it must be some minimum. Maybe you can imagine a world where we architect the wallet UX like that. Um... The second problem is just that when you go to do it engineering-wise, hey, if I'm doing one payment, I might need to have done like 10 queries in the background. Okay, am I doing 10 Zcash grade ZKPs in the background?

47:24 That's kind of a lot. That's the verbal sketch I just gave. There's tons of engineering tricks to improve that. Just look, someone's got to go dedicate a couple months to like bring that to reality. Which, great, there's a... That's a buy, that's a solvable problem. Okay, so this is the two halves of Zcash scaling.

47:42 There's the actual cryptography that's in the protocol on the blockchain that leans up the blockchain, makes it seem super sleek. I'm getting that image of the SpaceX engines. They start kind of complicated with wires everywhere. They end up pretty simple with very few moving parts. Kind of feels like that.

48:02 Makes the Zcash blockchain, the cryptography, very efficient, very fast. That creates a problem. It makes the wallets need to be really smart with how they keep up with all of the data going through the blockchain. But that's what Dave said with the FHE on the server, with the RPC that we just covered.

48:18 You put those two things together and you have a very fast scaled Zcash. one more ingredient, which is scalable proof of work. I was worried about that. Yeah. So it's three ingredients. You got two perfectly. The third one is just that Zcash as a blockchain today processes about 60 kilobytes a second.

48:37 In order to do a 50k TPS with the glorious Tachyon feature, we need 100 megs a second. okay, well, we're going to have to do a bunch of engineering stuff to go get us from 60 kilobytes to 100 megs. Well, step one is happening in like two weeks of just drop block times and keep the same block size. You know, 3x is the bandwidth, so 60 kilobytes to 180.

49:02 But then do a lot more of that. Start erasure encoding blocks, just like everyone was talking about 2017 and Solana does right now. And Ethereum does for the blobs, about the rest of it. Start doing that. Start just using more sophisticated gossip methods, similar to how Celestria does it as well for their fiber stuff.

49:24 And you start seeing that, hey, 100 megabytes is actually really viable. There's one other problem, one other aspect to it, which is that proof-of-work block times are super variable. I don't know if, I think a lot of people have really forgotten this problem since ETH merge. which when Zcash goes to a 25-second average block time, 1% of blocks are going to be super fast, 250 milliseconds.

49:48 So 100x faster. And then 1% of blocks are going to be super slow, like over 110 seconds. So 4x slower than normal. So the trick is going to be, over the next two years, how do you... how do you maintain high throughput while keeping the security as the single chain proof of work assumption that's like very familiar?

50:11 And it turns out there's tons of tricks over the different trade-offs. It's going to be, how do you pick which one is right for Zcash? It's just going to be like fun, community discussions. That's going to be the direction you go. Like it'll be a pretty straightforward kind of IMO, not really any trade-offs path to get to like, one to 10 megs per second of throughput.

50:33 And then the 10 to 100 is going to be, okay, time to introduce a lot of... something net novel that we like. The whole community features trade-offs. But while remaining, single chain proof of work. I'll admit, I never in my time in crypto did I ever think I'd be nerd sniped by something related to proof of work.

50:53 That is a new hurdle for me. I think this whole block time variance thing is like we've all forgotten the pain since Ethereum moved off POW. Right, right, right. Okay, let's wrap up scale and move into hardness because this is kind of like the other very big swim lane when it comes to Zcash. I think maybe let's start with quantum because that's the very sexy, very fun topic to talk about these days.

51:21 Broadly, what's the roadmap for Zcash to become post-quantum? What parts of Zcash are still quantum vulnerable today? And what's the plan for fixing it? We did this video back in, I think, April or something where we outlined this kind of roadmap for post-quantum cryptography and Zcash. And there were three big pillars of this.

51:44 The first one is something that you've probably heard about if you follow Zcash discussions on social media. It was called quantum recoverability. Yeah. The idea behind this is, do I have some money in the shielded pool? And then all of a sudden quantum computers show up. Can I get my money out? That's, you know, can I recover my funds?

52:04 And so if we add that to the protocol, it gives us like this buffer room or this like leg up over an attacker or like rapid advances in the cryptography. for example, and then it also allows us to feel more comfortable once enough people have moved into something that supports quantum recoverability that we can like kind of carefully and deliberately build more post-quantum tech in Zcash and people can gradually move over to that without worrying that people have to mass migrate all of a sudden, otherwise they're going to lose their money or something like that.

52:42 So that's the first pillar, and we've actually achieved this in Zcash. So we were talking about it in April. It's now live in Zcash as of a couple months ago. And so if you have funds in a shielded wallet in Zcash, you probably have them inside of this new shielded pool, which supports this. So great.

53:03 So that's one step in the right direction. So that assets in the terminology of Justin Drake are in their bunker. The Zek in the new shielded pool are inside a bunker mode. And we feel okay about that. Right, and you don't have to do anything. You don't have to do anything. They're in the bunker, so to speak.

53:20 But you can, yeah, yeah. Go ahead, Dave. Today, you can just go hide your wallet somewhere, come back 10 years later, and you can spend it. Yeah, that's a simple explanation. Okay, so the second pillar is privacy. So right now, like Dave was saying earlier, if you want to receive money in Zcash, you basically scan the whole blockchain and try to figure out which payments are to you, and that's done using pre-quantum cryptography because it's quite small.

53:54 And so we need to remove that and replace that with post-quantum cryptography. Okay. Uh, and so doing that as part of the tech is, is, is one of the elements of the Tachyon, uh, shielded pool. So Tachyon is going to solve this too. The Tachyon is like he was alluding to earlier is decoupling the cryptography from what the wallets use so that the wallets can use post quantum, uh, key exchange stuff like ML cabinet stuff.

54:24 Um, yeah. So after that's done, it's fully post-quantum private. Now today, Zcash actually has some elements of post-quantum privacy. So we have actually been thinking about this post-quantum stuff for a very long time. The protocol... like certain adversaries and in certain situations, it's already post quantum private today.

54:45 Like if you don't give your address out, uh, publicly, then your adversary can't, uh, can't de-anonymize or, or, or study your payments on chain. So if you keep your address private, um, but we're extending this to the whole thing. Another aspect, uh, that we've been sort of thinking about for a long time, actually quantum recoverability.

55:06 I believe we started building that as a community. Like the first specs were being written back in early 2025, I think. So that was a long time before everybody started panicking over quantum stuff. So we were, we were working on this for quite some time. The last pillar is post quantum soundness. So basically everything, Once you switch that over, the cryptography cannot be attacked at all by a quantum computer.

55:37 And we're completely done. So today, a quantum computer could show up and counterfeit Zcash by attacking a shielded pool. Once it's post-quantum sound, they can't do that at all. And those are basically the three areas that we need to roadmap. What's been kind of cool is that we discovered a bunch of intermediate ways to ship more of this since that first April thing as well.

56:03 So we got the quantum coverability fully through. On the privacy side, it turns out there's been additional boosts. So the Zcash near-intense integration now is actually 100% quantum unlinkable, which is like a new privacy step before we get to Tachyon. Sorry, it's quantum unlinkable and supporting wallets who use some PIR features, like ahead.

56:28 But we can get that. We can get... Well, what happened there was it turned out there's this element of the tachyon privacy design that was shippable today for Near Intense. So great. It's now shipped today in some of the wallets. Similarly, on the post-quantum soundness side, Okay, why is this harder for Zcash than every other chain?

56:52 Well, we're going to have to go from these elliptic curve proofs to these post-quantum recursive Starks. So a lot of engineering work going on. And Tachyon is... Every time you achieve recursion, it's a very big deal. It's actually an incredible technical feat for Starks. People should be proud of. So it's being done with the elliptic curves using very clever tricks to make one of the most advanced achievements there.

57:17 But Tachyon... And we have to go adapt that to Starkland. But we can bring the post-quantum pool, sorry, the transparent pool to being post-quantum much earlier. Similarly, you can also ship, we can ship the quantum recoverability code in the uh much earlier as well so then what what should look what you should see is that hey uh early next year you can now have fully post-quantum transparent transactions um maybe mid next year or you can demo that you can run the full path for like hey if a quantum computer appeared tomorrow we freeze liptick curves You can see in real time that like, look, the chain will let you do it.

58:00 You will go from a shielded pool to post-quantum transparent. It's there. So if we freeze the chain flip to curves, you still have access to funds is never lost. And then the final step of, okay, we've achieved the full post-quantum recursive start pool. So it sounds like there will be a moment where the entirety of the Zcash system is post-quantum, but the path getting there is actually incremental rather than like specific or there's not one specific day.

58:32 What are, maybe we could just trace over the actual big milestones for the big increments that happen between now and a fully post-quantum Zcash. Like what are the big things that listeners should, the big flags that listeners should just know about that are coming down the pike for Zcash? I think the biggest one is that quantum coverability is live.

58:52 And then post-quantum privacy should be fully live with Tachyon. Or Jan next year. So Tachyon is a very big milestone for Zcash in this step towards being post-quantum. And to understand that, once you have post-quantum privacy and quantum coverability, there's not that much to worry about. Like, some base level of trust of like, hey, the Zcash community, when they see a credible quantum threat that quantum's coming tomorrow, they'll proactively freeze elliptic curves.

59:22 If you believe that link, then you have just kind of not anything to worry about. And a lot of the quantum paranoia, I think, comes from a bit of not understanding how does attacking cryptography work in the world of... Let's say you had a magic quantum computer in your pocket right now. You're not really going to be able to break every single key, every single thing right now.

59:49 You'd have to have exclusive access to that and not leak anything to the rest of the world for a year plus. And then even more than that. And then Zcash is probably not my first target. It's probably a little bit further down the line after I take Satoshi's coins and also hack all of China. Yeah, and with Zcash, one more thing on top of that is that you would also need, you don't have an easy access to know the balances.

1:00:15 Are you just going to randomly check every address? Like, you can't just target the whales because you don't know the whale's address. Right, I don't know who the whales are because it's private, right? Yeah. Right, right. So there's some level of bunkerness that Zcash has implicitly based off of the nature of what it is.

1:00:33 Yeah, privacy gives you a lot. Maybe this is a tangent, but a lot of these phishing attacks depend on knowing what transaction to construct to steal your funds. That on its own already needs a viewing key, which is hard to get in Zcash. You cannot phish someone's wallet without a viewing key... So that's the quantum side of the equation.

1:00:58 But we're also recording this right in the middle of like the internet apocalypse, like Black October. A couple of weeks ago, Justin Drake had that tweet about, hey, it's like it's time for bunker mode. And this wasn't because of quantum. This was actually just because AI models are getting so good that like more classical tricks are becoming valid for breaking systems.

1:01:19 Yeah. So what do we think about this? Just like AI math getting so competent that aside from quantum, it starts to poke at or threaten cryptographic systems like Zcash. Sean, does stuff like this worry you? I guess the thesis here was that it was two things. One is that AI advances might attack classical crypto, and I haven't really seen a lot of examples of that.

1:01:48 The other is that it might compound advances in quantum computer development and things like that. So... I think that was a lot of the worry was that, oh, this stuff is accelerating. So whatever concerns you had about switching to post-quantum crypto before, you should probably be more worried now. I think that's like the generous takeaway from the bunker mode kind of panic stuff.

1:02:18 I think Ethereum is sort of hitched its like technical identity a little bit to some of this new cryptography because it, you know, resonates with the market. And they've also, you know, and they've invested a lot into this stuff over the years and like the cryptographers and engineers and stuff that worked on it.

1:02:40 So. they have kind of an implicit leadership position in that right now. And that can be abused a little bit because you can... I think that's a little bit what Justin's doing here is he's kind of taking advantage of the fact that they have that kind of leadership role. And you can be more and more Doomer And, uh, and, and, and try to like push the Overton window a little bit, uh, and, and kind of get away with it because the people on the other side are just like denying the threat entirely of AI or, uh, quantum computers and stuff like that.

1:03:20 And they look silly. So I think, I think Justin probably, uh, ran into it. Maybe, um, the, the, the extent to which he can be a doomer without, uh, looking kind of ridiculous. Yeah. That's just my personal view. What about the subject of formal verification, just to give Zcash longer-term, stronger, harder assurances about the hardness of the whole entire system?

1:03:43 We have been working on... So with Tachyon, we were already... writing, doing formal verification of Tachyon because Tachyon is actually kind of, it's using more esoteric cryptography. So like a year ago, we had already set up contracts with these like formal verification people to help us build this stuff and integrate it into our cryptography stack.

1:04:05 And so we were already kind of ahead of the game on that. Then this Orchard counterfeiting bug was And so we needed to basically rule out that it was impossible for any more counterfeiting bugs to exist. And you can do this with formal verification. Like we can mathematically prove that there are no undetectable counterfeiting bugs in the protocol anymore, inside of the shielded pool.

1:04:37 And so we had this like massive month and a half long or two month long sprint to prove that, to formally verify it. And we pulled it off and shipped this upgrade. And I think it's like, been hugely inspirational. I've heard from every project in the crypto world has messaged me and said, how are we going to do this for our protocol?

1:05:01 What did you guys do? How did you guys do this so quickly? It really matters, especially if you're using this tech, even if you aren't, but especially if you're using this ZK tech, there's so many ways to screw up and the damage is incalculable. So us being ahead of the curve on that really helped. I think the other thing is that we were also ahead of the game on the AI for assurance.

1:05:29 So we were attacking our own protocol very early on and eagerly with frontier AI models in order to find these... really difficult to discover bugs that had eluded auditors and cryptographers and hackers for years. And there turned out to only be one of them. And it was very, very subtle that only an AI could really find, apparently.

1:06:00 But because we were being really cautious, we were actually investing in things like that. And so... we're actually going to continue doing that. Like we think ahead, like what are the threats and attacks that we might face in months from now, especially with AI because there's different kinds of threats, supply chain risks, which we can talk about.

1:06:24 We need to think ahead and then, like, be very clever about defenses. What's kind of cool is formal verification is, like, getting more and more capable every month. Like, literally today, one of my friends made a post after this whole PHP incident about how do you do formal verification off of the raw assembly to protect, like, a PHP-like thing again, where...

1:06:48 TLDR, this PHP thing dependent on a memory management bug, which is C code's very well known for having as an issue. And it's like, okay, here's a recipe to protect against this for everything for the rest of time. And here's proof we've done it at Anthropic, which was compile the code, formally verify off the real code, a bunch of memory safety properties really apply.

1:07:14 Just I'm like, I think this is Anthropic in theorem cloud, whatever. okay, cool, let's start doing that. We formally verified the ZK stack. We fuzzed, or I say we, I didn't do it. This is all Sean and ZK security. Formally fuzzed the, the, hey, this form verification will cover every known bug. Even if we like injected a bug in the protocol, does it catch it?

1:07:41 I think the next phase is going to be, hey, do the same methodology. It was just first time announced today for memory safety on assembly to like every other type of bug that's possible in the raw full node itself. That, hey, this compiled code could not have a, there's no way to corrupt the database, this compiled code.

1:08:01 So with all this formal verification stuff, there's a ton of auditing to do with regards to all the code. Like Dave just talked about all this fuzzing, which is a term I once knew but not really familiar. Why do we believe in this, in formal verification? What does this really do for Zcash in the fullness of time?

1:08:20 So you can formally verify things. What does it mean to formally verify something? It means that you have some kind of proof that some code or some math is correct according to some property or, or specification. And that's really vague because the specification can be wrong. Like the, the, the property you're actually checking could be wrong.

1:08:44 The code or mass might add that you're actually checking might not match what you actually shipped in your, in your product. So you do need human beings to kind of look at this stuff and make sure that is it is it described correctly mathematically? It's not that they have to read thousands of math theorems and look at hundreds of thousands of lines of proof, lean code or proof code.

1:09:11 They just have to look at the surface level and say, is this security property written correctly? And can I attack it? And so you need to have auditors sort of looking at the formal verification process. like from that perspective. And what we did is we actually had a team called ZK Security go through.

1:09:35 These people are experts at formal verification work. They went through and did two things. One, they did that analysis I just told you about. So instead of auditing the code necessarily, they're actually looking at the formal verification code. The second is that they actually deliberately went through, they have this huge repository of, like a thousand or something like that, like bugs that have been found in Serenage proofs over the years, like inside circuits and inside of the actual protocols and stuff.

1:10:06 And they went through all of them and found like these common threads and said, okay, we're going to try to actually like inject these bugs into the code. Then we're going to go to the formal proofs and like adjust them a little bit and find out if it says, no, you can't do that. It's not secure. And they did it through all these and didn't find a single bug that they could inject into the into the code that would that would not actually surface at the layer of the formal verification, which is this kind of the fuzzing that is being mentioned.

1:10:35 So. The security assurance is looking, and I don't think anybody's ever done that before. I think we're the first people to ever do something like that. So security assurance. So you were poking at the ability for the formal verification to work in the first place. So you were like, rather than just auditing Zcash itself, you were auditing the thing that was auditing Zcash.

1:10:54 Yeah, and also like you were no longer looking for bugs in a sense because those are like gone. You're looking for classes of bugs that, that would escape the analysis. You're looking for bugs that could have existed but, and would not have been caught. And so that's like a level of like security. It's like we're at a higher plane of auditing than just doing, finding the actual bugs.

1:11:23 What's kind of insane is that this is like pioneered. I think it's like Zcash is like the highest for cryptography. And now it's like, I think everyone's trying to extend the same methodology to every other bug known to man. It's like your raw binaries. I think that's just going to be what the security story of the whole planet is next two years.

1:11:42 We've already started doing this a little bit. Like recently, Dave actually came up with these crazy optimizations that sped up our cryptography. And we wanted to deploy it in Zcash. Well, we already had it all formally verified. The changes we had to make didn't actually change the protocol. They changed the way that the proofs were generated, how they were kept zero knowledge private, basically.

1:12:08 And we didn't have a proof of that part of it because we didn't need it. We just needed a soundness proof for our system. But we have the whole protocol formally verified. So if we want to make a change, we can see if Dave's optimizations actually broke the scheme or not, broke privacy. We could just...

1:12:26 basically take the existing thing we have formalized and immediately get a proof that it's zero knowledge. And then we can tweak the parts that we wanted to optimize and immediately see that it was just as efficient or sorry, just as secure or at least quantify the exact security bounds on it. Which is like, it's also accelerating our ability to optimize things and feel confident doing so, which is cool too.

1:12:53 Super interesting, super interesting. Dave, something you said earlier that I want you to touch on is multi-assumption. I'm not sure if that's ever a subject that we've talked about on Bankless. What is multi-assumption security as it relates to Zcash and what does it do for it? Yeah. Okay, so this one doesn't have consensus among people, but the idea is that, hey, there's a couple of different cryptographic vectors to go break Zcash or anything, any blockchain in the world.

1:13:16 I'll hold, um... And so your security is just going to be the weakest of the three. So let's take, like, iron. If you break an elliptic curve, you've broken C cache. If you can break Blake 2B or Shaw 2, you'll have broken the pool. Well, so... What would it take to make it so that, hey, it's not that you have to break an elliptic curve or a hash.

1:13:46 You have to break both in order to get any bad outcome. So, like, one day when Zcash goes to fully hash-based cryptography, which is kind of the most secure because you can't really do anything without depending on hashes. So then let's say our hash is just SHA2 or Blake3. Yeah. Well, then there's like essential fear.

1:14:09 Oh, what if Blake 3 is broken? Are we fucked? So, well, okay, the natural response should be, what if we could do two hashes? What if you could be used like Blake 3 and SHA 2? And so if someone just broke Blake 3, no big deal. Go update the protocol. Because you're fine as long as both aren't broken in a short period of time.

1:14:31 And so I think the end state of Zcash will look something like that, of, hey, you've got to go break two assumptions, not just one, in whatever the final shielded pool is. Just because... you very rarely have one, getting a bug is very rare. That's kind of the point of this stuff. What's kind of cool is people have started this hash smash challenge for how do we break these hash functions.

1:15:03 It's almost inspiring that all this AI progress has barely budged the frontier. But okay, we still want to be paranoid hats. Let's go add two of these. So that's what multi-assumption is. I kind of think the final state of a lot of cryptography is going to end up being deploy such that you have to break two things and maybe raise what we currently call 128-bit soundness to like 140-bit or 160-bit just to account for the fact that, hey, we're exponentially growing the world's compute.

1:15:37 And I think that, yeah, it's probably that state. Okay, and this sounds very similar to like a multi-client setup, where if one client breaks down, the other client holds fast and keeps the system up and running. And so it's not just enough to break one thing, you have to break both at the same time to actually attack the system.

1:15:54 You said this doesn't have consensus with Zcash, so this is just like a Dave idea about long-term security and you still need to get Zcash consensus? Call it a day by day is like free. Oh, I'm really generous. I think a lot of people independently agree with it. But now there's a bunch of details when, how, and if.

1:16:12 Sure, the normal blockchain governance process. Yeah, yeah, yeah. I think it's been, Sean probably day one of us first mentioned way, way before I got involved. Oh, yeah. No, we were talking about it back before Zcash was launched. I think Zuko was a huge fan of doing multi... having multiple proofs cover the same transactions and just like paying the cost of them being like twice as large.

1:16:37 But one of the proving systems could fail and the other one would basically save you. Which is morally equivalent to what Dave's talking about with the hashes, basically. It's been talked about. I think it... I'm not... I might be one of the ones that is kind of pessimistic about it because of how it interacts with scale and things like that.

1:17:01 But, you know, my mind's open. First got to achieve scale. I think that's also earlier. Like, so much of Zcash is hampered by the scale problem. I think people realize the issue of today the chain's max capacity is 2.9 TPS and the wallets would start choking. Or if you rewind 6 months ago, the wallets would be choking then.

1:17:23 next upgrade makes the capacity 6.5 TPS and we're worried about the walls when they hit around 6 TPS fully used. Okay, well, first... When you're in that mentality, every unit of scale matters a ton. Anything that impedes. When we're at the 50 to 100k TPS, we have a lot more flexibility to start doing stuff.

1:17:48 Once we've broken the fundamental wallet tension and fundamental chain scaling tension. I've been trading crypto for almost a decade. And I've used so many different wallets, exchanges, aggregators, or front ends. And I'm basically always looking for the same thing, just one interface with a deep liquidity across a bunch of chains and assets where I can access markets like perps, earn yield, trade confidentially, and still control all of my funds.

1:18:09 And I've never really found it. And I'm just always switching wallets, juggling gas fees, or getting eaten by slippage. But near.com feels fundamentally different to me. I can do anything I want from any chain and keep all of my activity confidential. Crypto, tokenized assets, perps, payments. I can even earn yield confidentially.

1:18:27 One account, over 30 chains, confidential by default. It's the way that crypto ought to work. And it's powered by Near, which has moved over $30 billion cross-chain, uses post-quantum signatures, And that's run over five years on mainnet with zero downtime. Near.com is the best way to be on chain and be in control.

1:18:44 Get 20% of your trading fees back on near.com using the bankless link in the show notes, not investment advice. Some exciting news. We are launching a new podcast to help people figure out the crypto cycle, how to navigate it. The best crypto cycle investor I know, his name is Michael Nato. He runs the DeFi Report.

1:18:59 This is the guy that sent me a sell alert before the 1010 price drop happened. His cycle analysis has been absolutely on point. I've been following him for years. And this year, we started recording weekly podcast episodes. Each one, we get into his portfolio, what he's holding, the market structure, entry targets, fair market value of Bitcoin and Ether, and where we are in the cycle.

1:19:19 There's new episodes that are released every Wednesday. They're 30 minutes, they're short, they're punchy. I think this crypto cycle is harder to navigate than most. So let's do it together. Go subscribe to this podcast. Search the DeFi report wherever you get your podcasts, YouTube, Apple, Spotify, or find the link in the show notes.

1:19:35 There's a new episode waiting for you now. Guys, I think that wraps up the technical roadmap part of this podcast. I learned a lot. I really appreciate you guys spending the time and walking me through this. I want to kind of zoom back out and go back into the philosophy side of things. because my brain hurts and I think that's more fun anyways.

1:19:54 Maybe we can kind of bang through some of these as we wrap this podcast up. I want to talk about expressivity and Zcash. So Zcash has chosen to follow Bitcoin in a lot of its design philosophy to be pretty reductive, pretty simple, pretty narrow. as opposed to the Ethereum strategy to be expansive, complex, broad, general.

1:20:18 Why is this the right choice for Zcash? And where is that line between Bitcoin and Ethereum that Zcash determines its correct place to be? And how does it determine that that's the place to be? Sean, I'll throw this one to you first. Yeah, so I'm sure Dave has great thoughts on this as well. I personally think Zcash would be kind of screwed.

1:20:44 Zcash would be like cooked right now if we had added all these crazy features years ago. Like during, as you may know, Zcash for many years was not doing very well in the market. It had a pretty low price. And so there was a lot of people who were trying to just like throw anything at the wall that they could.

1:21:03 So during like... the DeFi revolution, everyone was talking about programmability, private programmability sounds really cool for Zcash. So, you know, I was even co-authoring, I even co-authored a paper that turned into a protocol that does that sort of stuff. But, and then, for example, like you have these things you've probably heard about, like CSAs, shielded assets in Zcash.

1:21:34 People were kind of thinking, oh, yeah, we'll jump in on the meme coin stuff and that'll get the price up or something like that. So there's lots of people that were trying to add these features. The problem is that we would be really screwed right now if we were trying to change the protocol to scale it.

1:21:52 if we had those features, because then we'd have to accommodate them. And that would make the process way more complicated. It would make it really hard to secure it too. So... All these features add tons of surface area of attacks and bugs. And especially in something like a zero launch proof system, where one little bug in something that seems like it shouldn't matter can actually break the whole thing and screw everything up.

1:22:20 And it doesn't isn't just isolated to like once one little part of it can break everything just because you have this feature. And so it would hurt our agility. And also, it's just difficult to architect a blockchain that can scale with all these features. We needed to solve payments. And so my focus for years has been until we scale payments, we shouldn't even talk about payments.

1:22:47 all these other things. We should keep it simple. Now, then we can talk. I think there's this growing movement inside of Zcash away from thinking about adding these kinds of features simply because we don't want to jeopardize the security of the project. So I think by the time we get to around to scaling payments, we probably are going to like be a lot more conservative by then.

1:23:09 But I don't know what Dave might think about it. Yeah, I guess maybe there's two parts of what do I think is the expressivity you want? I think Zcash is missing two units of expression that have really hampered the rest of like Bitcoin. One is, I think we want expressivity of custody methods where today and Zcash just have this one private key and then in order to get a multisig you do an off-chain MPC to get a multisig.

1:23:39 That's pretty cool but I think the world's kind of learned that, hey, we want a lot more out of this. Like, you see the whole push for pass keys is, okay, well, the technical question is, how do you get SEC2P56R1 instead of K1 support on the chain? Well, that's a new custody thing that we should have expressivity for.

1:24:03 But what's kind of cool is that, oh, you can imagine that's something that's uniquely enableable with recursion and some feature of tack-down state. The second point of... The second point of like featuredness I think you want in the end state is trustless like client bridges between two chains. So this is what like really enables things like L2s or whatever.

1:24:26 Things like, hey, you want Zcash to change. You want Bitcoin to change. You're not succeeding. But okay, can you go, do you want a theory or change? A theory or not? How can you make a minimal extension? So... Beyond those two, I don't really see anything else. And I don't even want to entertain those two, which I think matter most for payments, until we hit scale.

1:24:52 So I'd probably be convinced that ZSA, or you could probably convince me that, oh, hey, a meme coin is not a thing that should be blocked. I just think that it's crazy to put brain cells towards that when you're at a blockchain with 75-second blocks and three TPSs. I want to be begging for no usage of anything but the core protocol in that certain world.

1:25:16 Okay, when we're at a world of 50,000 TPS and like, please help us saturate this sub-second latencies. Okay, then it's like a more interesting question. So yeah, until you hit that like scaling path, I view anything but those two points of expressivity I point out as a distraction. And those two I only care about because I think they actually help accelerate that path.

1:25:43 Like, I think you can get a better, I think Near Intense could be even faster, even better UX to people if it had more trustless or better native custody. What about the long-term security plan for Zcash? So as we've talked about, proof of work is the plan A for Zcash. It will remain the plan A for Zcash as far as I can tell.

1:26:04 Zcash is also a 21 million hard cap supply. That also begs the question about, okay, how do we pay for the security budget in the fullness of time? So what pays for Zcash security in like 2100? What's the thought behind long-term Zcash security? Yeah. One is there's this thing called the NSM or Network Sustainability Module, which the idea is that, hey, collect a bunch of transaction fees now and allocate these transaction fees that you collect towards future miner emissions.

1:26:33 So starting the next upgrade, 60% transaction fees are not given to the miner. They're instead held by the protocol with intention to start being distributed to miners under a similar halving schedule, but beginning four years from now. So the thesis is like, hey, while Zcash price is lower than the goal end state, start collecting this now that will help this future problem.

1:27:02 Is that the plan or is that just a proposed plan? That is a merged plan that begins in two weeks. Oh, that is in the chain. That's happening. Yeah. Yep. That begins November 5th. And then the redistribution will happen in four years, 20... Whatever. I don't know the date online. But the collection begins two weeks.

1:27:27 then there's a fair question of, is that sufficient? Does that, is that going to cover, is that and scaling and like market usage sufficient to cover the long-term or not? That's a valid question. Do we have an answer to that question or is that just something to think about for the future? Well, I mean, it's a similar thing to what's nice is Bitcoin's a bit of a canary here, right?

1:27:47 That so far, Bitcoin's, this hasn't been a problem for Bitcoin. And in fact, Bitcoin's had a worse problem with like the DATS being incentivized to go acquire hash rate because that gives you public market memetics. And then, oh, it doesn't actually work. So all the miners have to like shut off. And so you have a surplus ASICs.

1:28:06 Do I think it's going to work? I think so. I think the op-ex of it, or I think at the point where this becomes, if you're in the extreme success case, it's probably going to work. And then you're also able to start relying on altruism a little bit of like, this is worth so much to people that like, they should just go run miners.

1:28:29 I think the most interesting thing to me is that if you go ask the Bitcoin community, the average person will just tell you, it's not a problem. Like, stop funding my coin. The security is going to be totally fine. And what I'm hearing from you guys is that we're keeping an eye on it and we are actually willing to make changes based off of data and reality.

1:28:53 Right now, our focus is speed and scale. And at some point, security will get its place in line in terms of the priorities for Zcash. That's not today. We've already solved some amount of it with the collecting payments now to pay for security later. So there is some sort of like admission that Zcash makes that Bitcoin doesn't, which is security is real and it's not a manifest destiny for Zcash to just be secure.

1:29:20 But in terms of priorities today, it's not first or second. It's kind of what I'm hearing for you guys. You can literally go query your LLM with Bitcoin that there is a day when it is zero Satoshis given to miners. Like, I don't know, you can say that's not a problem. Yeah. Governance and coin voting.

1:29:36 I'm kind of starting to turn this into a lightning round because I know I'm keeping you guys over our time. How does Zcash governance work? How do you have Zips, Zcash improvement proposals? How do they contrast to BIPs or EIPs and Ethereum land? Broadly, how does a change happen to Zcash? So historically, we've had, it's been, there's no like written constitution for how the protocol has evolved.

1:30:03 It's been basically, uh, people with some legitimacy, with some diverse, uh, diversity amongst different organizations in Zcash that all happened to come to a consensus over what to do with no, probably no objections amongst, uh, vocal proponents of the project. So basically we just do whatever, uh, isn't controversial and, uh, has alignment amongst, you know, uh, competing organizations in the project.

1:30:35 Um, we have this like thing called a, uh, a zip process, which is a process essentially for specifying and coming to an agreement over what it means for the protocol to change and in what ways it changes. Um, yeah. I think of that process as kind of ministerial in a sense. It's like really valuable to have all this written out and described in detail.

1:31:02 But it isn't the governance process. It's like downstream of the governance process. And so we've been kind of lacking this like actually coherent governance system. Recently, over the last several years, especially over the last year or so, we've been going all in on coin holder voting. So coin holders have been able to voice their opinions on retroactive grants and things like that.

1:31:38 In Zcash, so we have this grant program and there's a lot of money that a lot of Zcash tokens or coins that are sitting in a pool that can be distributed to people who request it. And the coin holders vote on that. And this has only been improving and improving. And recently we had this like $7 million or whatever it was coin holder retroactive grant vote, which is awesome.

1:32:02 And we also had recently for the first time, or it isn't for the first time, but I think in a significant way, we had this massive coin holder vote on what should we do with the next upgrade with NU7. And it received millions of Zek participating, or I forget exactly how many, but it was a lot. Yeah.

1:32:25 And I think the direction we're moving, we should move, is if coin holders broadly agree with something, or rather if they disagree with something, we definitely shouldn't do it. That's my personal view. And so we're starting to actually have a coin holder-based governance system as time goes on, I believe, is sort of what's happening.

1:32:50 And it's not a formal vote, like it's not on-chain governance, it's a temp check. And I think the thing to pay attention to is how strong does that temp check actually change the future? Is that just a weak temp check or is that, oh no, ZEC holders really want this and that is very important to the broad weighting of all inputs?

1:33:11 I think it's really important for us to signal that it really matters what the Zek holders think. It's an accountability mechanism for us as developers. Like they are the like Zek holders are the lifeblood of the project. Yeah. But it's like, obviously, if Zekholders did something ridiculous and like voted for something that is like that we would never do that would violate our morals, like, of course, we're not going to do it.

1:33:38 But we should signal that. Like backdoor, like for some reason, Zekholders are voting for backdoor privacy to hand it off to the NSA. Right. And for whatever reason, they wouldn't do that. They wouldn't do it. And it's ridiculous. But you wouldn't do it either. We wouldn't. Yeah, exactly. Right. One thing kind of cool about Zcash is it's actually extremely decentralized at the development side as well.

1:33:59 So there's a bunch of development orgs with a lot of say and stuff. So you want to solve this problem of like, okay, they don't all agree or you work at the slowest person's like preference. Well, one thing I think everyone will agree on is, hey, if the coin holders are very opposed, like you're getting a bunch of people saying, we're going to go sell our Zek of like 10, 20, 30% of supply if you do this.

1:34:26 Well, okay, obviously you fucking shouldn't do it. Like, yeah. I don't think there's, if we're like Mericradic and whose voice matters, like, it's hard to ever justify doing something that all coin holders are against. So I know there's other people about like wallets, whatever, community members, people who build their stuff on top.

1:34:46 But it's hard to distinguish importance even across felon orgs. Like coin holders are the end state most neutral. I know both of you can only speak for yourselves individually, but is the price of Zek important? Is Zek supposed to be a high price? Is that kind of one of the inputs as to why you guys are working on it?

1:35:06 Obviously, privacy is important. Financial privacy is important. But is the price of Zek, a high price of Zek, one of the outcomes that both of you guys are working for? I think it's a requirement in kind of like financial gain. It's a requirement to hit the dream of having thousands of payments per second.

1:35:25 And okay, you want tens of thousands of payments per second. Well, you need tens of thousands of payments per second of demand. Okay, so you need, does that mean you need 100 million people holding it? Well, okay, if you have 100 million people holding it, do they need to have like 1,000 on average, et cetera?

1:35:43 And you start getting to, oh, you must have high market caps in order for this to like make any sense. You cannot coherently demand, like say this should be, we should have MasterCard Visa level TPS and so therefore 50K TPS and think that there's a low R-cap works. It doesn't make any sense. Sean nodding in agreement.

1:36:05 Yeah, I think... a high prices act is like, you know, the flywheel of protocol evolution and defending the protocol and, and succeeding. It just depends on it. I think historically, uh, has been evidenced by, uh, All the resources we have right now to develop and build things, it's massively higher than it was a couple years ago because of the exact price.

1:36:33 And now there's a lot more built-in long-term treasuries in the community as well. So that has solidified and provided us with some confidence in the long-term vision of the project, which is... You need that to make any progress. If you wanted to take down Zcash, what would you do? So say it's your imaginary job to cause as much harm as possible to the project.

1:37:02 You break encryption, halt the chain, whatever. Your goal is to do harm. What do you do? This might get me in trouble later Whatever I'm about to say I think the greatest problem is stasis How do you inject stasis? You make a bunch of committees And a bunch of You know the whole NSA playbook Okay, so you attack the governance layer Yes.

1:37:29 And so you have a bunch of committees. You can only work, you can only proceed if the slowest member succeeds. And then, yeah, I think the way you'd, at the current stage, the greatest threat is takedown by slow committee. I totally agree. So it's the Zcash governance that would be the place that if you wanted to stop the project, you would start fucking around with governance.

1:37:54 Oh, yeah, I guess maybe two parts. I guess governance on the second is monetary supply, which is downstream governance. Okay, fuck up, fuck with this. And then fuck with the ability to update. And fuck with the ability for allowing governance to do maybe updates to compromise core values. Dave, Sean, this has been an absolute masterclass in Zcash.

1:38:15 I really appreciate you guys coming on and teaching me and the Bankless Nation everything that we talked about here. Hopefully we can check in again about the progress in Zcash in a year or so. But as for now, I think this was everything I needed to know about the project. Thanks so much. This was awesome.

1:38:29 Thank you. Great questions. Bankless Nation, you guys know the deal. Crypto is risky. You can lose what you put in. This is the frontier. It's not for everyone, but we are glad you're with us on the Bankless Journey. Thanks a lot.