Blobstream X: Streaming Celestia DA to Ethereum with Succinct’s ZK Tendermint Light Client
For the past year, Succinct has been working on making interoperability more secure by building open-source, production-ready, trust-minimized on-chain light clients, enabled by ZK technology. The succinctness properties of ZK proofs function as the “ultimate precompile” for the EVM, where any computation, no matter how complex, can be verified for only ~200k gas.
In the context of light clients, this is useful for cases where the validator set size is quite large (such as Ethereum) or where validators have a signing key too expensive to verify in the EVM (such as Celestia). By using ZK proofs, bridges no longer need to take shortcuts and rely on centralized multisigs with harmful trust assumptions. Instead, they can simply use ZK to run a gas-efficient light client on-chain for trust-minimized interoperability.
Blobstream Architecture
With the completion of Succinct’s ZK light client for Ethereum and subsequent production deployment in securing Gnosis Chain’s native bridge, the Succinct team started collaborating with the Celestia core team to build a ZK Tendermint light client to power Blobstream: Celestia’s data availability solution for Ethereum. Blobstream’s architecture relays commitments to Celestia’s data root to an onchain light client on Ethereum, for integration by developers building Ethereum-settled L2s.
Blobstream requires an Ethereum smart contract to run a Celestia light client to verify what data has been committed to Celestia. Concretely the smart contract first verifies enough validators participating in Celestia’s Tendermint consensus have signed off on a series of blocks, then stores a Merkle root accumulator of all the data hashes for this range of blocks. L2s can use the stored Merkle root of data hashes in the Blobstream smart contract to verify that their transaction data was appropriately published to Celestia in case of a challenge (optimistic L2) or in the process of verifying a validity proof (ZK rollup).
Blobstream X: Upgrading Blobstream with ZK light clients
Verifying Celestia validators’ Ed25519 signatures in the EVM is prohibitively expensive due to Ethereum’s lack of a corresponding precompile. Without a ZK solution, Celestia validators must maintain a separate set of secp256k1 ECDSA keypairs that are solely used for signing data hash attestations that are verified in the Ethereum Blobstream smart contract. The largest drawback of this design is additional burden on the Celestia validators and complication of the core Celestia protocol by introduction of Blobstream-specific extra logic. Furthermore, in the case of Celestia scaling beyond its initial validator set size, this approach does not scale with respect to gas costs. ECDSA signature verification is roughly ~3000 gas and ~1000 calldata per signature. As an example, to verify 100 validator signatures onchain amounts to ~400,000 gas, which is quite expensive.
One of Celestia’s core values is simplicity and minimalism of the base layer. With a ZK Tendermint light client powering Blobstream, validators will need to only custody and sign with their necessary Ed25519 keypair. By upgrading to Blobstream X, Celestia can remove all special-case logic involving data attestations and reduce burden on its validators, allowing it to advance on its core values of simplicity and minimalism. Additionally, Blobstream X future proofs Blobstream's architecture, allowing Celestia to add arbitrarily many validators while paying the same on-chain gas costs.
State of the Art ZK meets State of the Art DA
To build a performant ZK Tendermint light client, our team had to implement several state of the art primitives. Specifically, we created an incredibly optimized EdDSA batch signature verification (the fastest open-source implementation we could find), and highly performant hash functions (SHA256, SHA512) built on top of our open-source Curta “AIR-builder” library. We’re excited that our ZK Tendermint light client will be powering Blobstream and we’ll be releasing more details on the ZK Tendermint implementation in the coming weeks.
It is only fitting that Celestia's state of the art DA is being streamed to Ethereum with a state of the art ZK light client. Collaborating with the Celestia team has been a privilege and we’re thrilled to be powering a core part of their ecosystem and building towards a proof-based future.