Last night I had the opportunity to speak at NEBRA’s “Proof Singularity” event as part of a friendly “heated debate” on the relative merits of programmable cryptography and programmable incentive systems - in the context of scaling blockchains. We spoke, in effect if not in name, about coprocessors, and what the resounding effects of ZK on validated computation would be. The panel was recorded, and while I recommend watching the video once it’s live, I’ll also lay out my predictions of the market structure of coprocessors in more detail here.
Our discussion is largely about coprocessors, which are a category of systems that can perform computations off-chain while proving or otherwise guaranteeing their results on-chain. A ZK coprocessor is one which uses Zero-Knowledge techniques to produce succintly verifiable cryptographic proofs of computations. A cryptoeconomic coprocessor is one which uses value-at-stake and an interactive protocol to provide strong guarantees of a computation’s correctness. For a deeper primer on cryptoeconomic coprocessors, I recommend a look into this article from Polytope Labs. The challenge I have given myself here is this: I will make extremely strong assumptions about the possible future of cryptographic coprocessors, and evaluate the future market structure for coprocessors on that basis.
I’ll insert a brief detour to address the point that ZK coprocessors and cryptoeconomic ones are not identical in capabilities. This is true. Despite that, they are substitutable for many use-cases. ZK coprocessors are able to handle large quantities of data without imposing additional overhead on the blockchain, which implies that cryptoeconomic coprocessors will be better for tasks that are relatively computation-heavy rather than data-heavy. ZK, notably, can also provide user privacy. On the other hand, cryptoeconomic coprocessors have access to hash functions, cryptography, data structures, memory layouts, and hardware advantages that ZK ones don’t. They’re not exactly the same, and so they are only partially-substitutable.
Let’s cut to the chase and turn to the key question of the article: what will the market structure for coprocessors look like once ZK coprocessors are in full swing? Based on an analysis of economic principles, I draw three conclusions. The first is that cryptoeconomic coprocessors will be able to sustainably undercut ZK coprocessors on price. The second is that there is an effective price ceiling for cryptoeconomic coprocessors. The third is that cryptoeconomic coprocessors can operate profitably in this environment.
I focus my analysis on two different properties of coprocessors: their cost and their price-elasticity. Cryptoeconomic coprocessors are lower cost, but also much more price-elastic than ZK. The reason for this price elasticity is that they rely on a set of specific validator nodes, a non-substitutable good. The lower cost allows cryptoeconomic coprocessors to undercut, and the price elasticity implies that their ability to do so is bounded. The open questions are just about how much demand it takes to saturate cryptoeconomic coprocessors.
Proof Aggregation is a technology so powerful that it seems to border on magic. To briefly recap, it enables practically unlimited amounts of zero-knowledge proofs to be aggregated into a single small proof that can be extremely cheaply verified. When used in a blockchain context, this means that enormous amounts of computation can be proven and aggregated off-chain and a very small “receipt” of all of these computations can be posted to the blockchain to verify, while placing scarcely any load on the blockchain nodes themselves. Nifty.
But there are limits to what you can accomplish with proving alone. It’s worth taking a step back and anchoring this discussion in the main purposes of consensus systems. Consensus systems exist primarily for the ongoing ordering of events. The job of a consensus algorithm is to choose from many possible valid orderings of events. The most famous version of this property is the Double-Spend Problem. While it would be valid for me to send my coins to either Alice or Bob, I cannot send them to both. The consensus protocol must choose one of these competing futures if I try to double-spend. I’ll also note here that the utility of aggregation is somewhat undermined by the desire of block-builders to reorder transactions for profit and capital efficiency. As a consequence of this need for ordering, a pure ZK proponent might posit a future where a consensus protocol is used for nothing other than ordering aggregated cryptographic proofs.
The economics point to a more likely outcome being a balance between the two categories of coprocessors. The primary reason for that is the cost differential of the two. ZK Proving is expensive, and proving hardware costs money even if the burden on the chain is amortized to near-zero. We will focus on these hardware costs and charitably assume aggregation and verification are zero-cost. Wei Dai (1KX Research) estimated a 6-order-of-magnitude difference in hardware cost to prove something versus executing it. I’ve arrived at a similar factor when comparing the stated cost-per-gas of Polygon ZkEVM with the raw hardware costs of validating computations on Polkadot. These costs may come down substantially, but even the most optimistic estimates assume at least one order of magnitude difference. All this to say: for the foreseeable future, there are serious cost differentials, and ZK’s costs are cryptoeconomic coprocessors’ potential profit margins.
I’ll write a bit about Polkadot here to establish where this cost differential lies, though Polkadot is not the focal point of this article. Polkadot provides a set of cryptoeconomic coprocessors we call cores. They can execute arbitrary WebAssembly, and soon RISC-V, code. Each core requires between 30-40 validators to execute each computation. This scales sub-linearly with the number of total validators. The hardware cost of processing a computation on Polkadot can be slightly overestimated with the cost of renting 30-40 decent single-cpu VPSs for 6 seconds.
Beyond those cost differentials, we must also look at price-elasticity: how demand affects the price of each option. ZK coprocessors have the edge here, because proving can be done on any GPU in the world - a veritable ocean of hardware. In contrast, a cryptoeconomic coprocessor relies on the hardware of specific validator nodes, and all demand for the coprocessor is proxy demand for those specific machines. Consensus systems relying on non-substitutable validators to validate blocks is a huge pain point: it makes those validators a potential bottleneck for the system, with fee spikes ensuing during periods of high demand. ZK coprocessors, on the other hand, can simply add more GPUs with near-zero price impact. This causes the ZK price/demand curve to look much like a flat line, while the cryptoeconomic price/demand curve has increasing upward slope in relation to demand.
The effect that I expect to see is that ZK-proof aggregation establishes a (soft) price ceiling for cryptoeconomically validated computation. All else equal, why would someone want to pay more to validate their computation on a cryptoeconomic coprocessor than a cryptographic one? There are some reasons, like state locality and liquidity, that I’ll put aside for now. Despite this price ceiling, the potential profit margins for cryptoeconomically validated computation are very large. This implies three relevant questions for the future of cryptoeconomic coprocessors:
- How well can cryptoeconomic coprocessors scale with more validator nodes? In the diagram, this corresponds to the slope of the green cryptoeconomic curve.
- How low can cryptoeconomic coprocessors keep their hardware costs? In the diagram, this is the y-intercept of the cryptoeconomic curve.
- How applicable is Jevons’ paradox to validated computation? This is the point on the x-axis where real demand will lie.
The answer to the first question will tell us how price elastic validated computation cryptoeconomic systems are and how much demand they can absorb. The second tells us how efficient ZK proving has to get before the cost differential disappears. And the third tells us how likely it is for abundant cheap computational power to be consumed by demand. This third is very important - one argument I anticipate to this post is that ZK coprocessors will simply be “cheap enough” and therefore users won’t seek alternatives. But if Jevons’ paradox is applicable, the volumes of validated computation consumed by users will be large enough where these margins do matter. We can only speculate. Personally, I see Solana as a point in favor of Jevons’ paradox as applied to validated computation.
Beyond just undercutting ZK coprocessors, cryptoeconomic coprocessors can be profitable while doing so. We’ve established that cryptoeconomic coprocessors will only be able to undercut ZK up to some equilibirum point, which is where ZK is approximately the same price. Assuming ZK compute is not sold below cost (although in practice it may be temporarily subsidied at large expense to capital), the cost differential between the two approaches is the potential profit margin for cryptoeconomic coprocessors. Even with the most charitable assumption that ZK will eventually get to one order of magnitude of cost away from standard compute, strong profit margins will be sticky for cryptoeconomic coprocessors relative to ZK ones.
Here are a few disclaimers to round things out. First, I hold an emotional and financial stake in Polkadot, which uses cryptoeconomic coprocessor technology. Second, I don’t intend for this post to be read as somehow being “against” cryptographic approaches. They are extremely powerful and further the mission of providing private, scalable computation for every individual on the planet, one I am very much aligned with. All that said, I believe my mental model here is robust and makes the case for the stickiness of cryptoeconomic coprocessors quite clear and I have written it with my best effort of impartiality.
Thanks to Pepyakin, Matti (ZeePrime) for review and proofreading.