Tendermint X: The first open-source, performant ZK Tendermint light client built with Succinct

Overview 

Nearly six months ago, we launched Telepathy, our implementation of “proof of consensus” for Ethereum. Today, we are excited to announce Tendermint X, the first open-source, performant Tendermint ZK light client for the EVM, deployed with the Succinct platform. Tendermint X finally brings to production the long-lived dream of connecting the Cosmos to Ethereum with a trust-minimized ZK bridge.

Tendermint X is MIT licensed and allows anyone to deploy a gas-efficient (~350k gas per update) Tendermint light client for any compatible Cosmos chain, with a 4 minute end-to-end proof generation time. Using the Succinct platform, setup of smart contracts and circuits for a production-ready deployment takes around 20 minutes. Tendermint X is the core technology being used to power Succinct’s previously announced Blobstream X collaboration with Celestia, which brings Celestia DA to Ethereum using an onchain Celestia light client and is live on testnet today.

Background

Tendermint is a BFT consensus algorithm used by over 50 deployed chains primarily in the Cosmos ecosystem, including Osmosis, BNB, dYdX, Celestia and more. Chains in the Cosmos ecosystem are natively connected with IBC, an interoperability protocol that uses light client verification to enable trust-minimized connections, providing seamless interoperability. However, Cosmos has long lacked a trust-minimized connection to Ethereum, because of the infeasibility of running a Tendermint light client in an Ethereum smart contract, due to prohibitively high gas costs. An open, trust-minimized connection to Ethereum has long been a goal of the Cosmos ecosystem in enabling a fully connected Interchain, and a gas-efficient, performant Tendermint light client is a key leap in making this future possible. 

As a recap, light clients efficiently track the state of a blockchain with minimal trust assumptions using cryptographic methods. Light clients are useful in several different contexts. In the case of bridging, gas-efficient, onchain light clients are key in making bridging more secure. Instead of needing to rely on a multisig to verify transactions that are being bridged from a source chain to a destination chain, a gas-efficient light client verifies that transactions and blocks are finalized on a source chain by leveraging the security of the validator set of the source chain itself.

Verifying Tendermint consensus

Previously, there was no feasible way to verify the Tendermint consensus protocol in the EVM due to the lack of a precompile for Ed25519, the default signature scheme used by Cosmos chains. Existing Solidity implementations verifying Tendermint consensus cost in the range of ~25M gas. However, ZK can come to the rescue! Zero-knowledge proofs function as the ultimate precompile for the EVM–allowing developers to utilize arbitrarily complex computation in the EVM for only ~200k gas. Verifying a ZK proof of Tendermint consensus involves verification of the following primitives:

1. Ed25519 validator signatures
2. Protobuf serialization
3. Verification of Merkle proofs against the block header
4. Computation of the Merkle root of the validator set

The most computationally intensive primitives are the Ed25519 signature verifications and SHA256 hashing. Existing open-source implementations for ZK proving a single Ed25519 single signature take ~3s, and implementations for proving a single SHA-256 hash take several seconds, resulting in undesirable performance. For a realistic, production-grade implementation, we dramatically improved performance of these primitives by using Curta: our open-source library for writing AIR constraints, to create STARK-based accelerators for SHA256 and Ed25519. With Curta, proving times for Ed25519 and SHA256 are 500ms per signature verification and 20ms per hash, an order of magnitude speedup. Because STARKs have larger proof sizes and expensive EVM verification costs, we utilize a groth16 wrapper to recursively verify these STARKs and wrap them in a SNARK for efficient onchain verification.

Benchmarks

We provide benchmarks for generating ZK Tendermint verification proofs of the validator sets of 3 different chains: dYdX, Celestia and Osmosis. The proving time scales with the number of validators of a chain and benchmarks were run on a 64 (virtual) core machine. The end-to-end proving time described includes the time for generating the STARK proof and wrapping it in a groth16 proof, and also includes non-proving costs such as loading circuit binaries into the Succinct platform’s auto-scaling cloud-based prover.

Deploy Tendermint X in <20 Mins

Tendermint X is easily deployable in less than 20 minutes on the Succinct platform. If you’re interested in deploying Tendermint X for a Tendermint chain, simply follow the guide at: https://github.com/succinctlabs/tendermintx#integrate-tendermintx. It involves forking the repository, creating an account on the Succinct platform and connecting your project, and then putting in the relevant RPC urls for your chain and running a few circuit builds. If you’re interested in deploying Tendermint X, please get in touch with us: https://alpha.succinct.xyz/partner 

Applications of Tendermint X

Currently, Tendermint X is being used to power Blobstream X, which brings Celestia DA to Ethereum by running a Celestia light client on-chain. The goal of Blobstream X was to extend Tendermint X to also prove Celestia’s data root commitments efficiently, and only required additional ~300 LOC. Using Blobstream X, L2s can use the stored Merkle root of data hashes in the Blobstream smart contract to verify that their transaction data was appropriately published to Celestia in the case of a challenge (optimistic L2) or in the process of verifying a validity proof (ZK rollup).

Beyond Blobstream X, Tendermint X provides the foundation for a trust-minimized connection between Cosmos and Ethereum. We would love to see other applications built with Tendermint X, including gas-efficient ZK IBC to bring IBC to Ethereum and integrating Tendermint X into existing Cosmos/EVM bridges to provide more security.

If you’re interested in building on top of Tendermint X for any of these use cases, or others, please fill out: https://alpha.succinct.xyz/partner.