The Complete Zcash Roadmap | Sean Bowe and Dev Ojha

Host (David Hoffman): Every time Zcash made a technical decision, the rest of the industry copied it. This was namely Ethereum.

Host (David Hoffman): When you use a transparent ledger now, you should be actually really nervous.

Host (David Hoffman): Do you have better anonymity in a system that has a thousand payments per second or one payment a week? Obviously a thousand payments per second.

Host (David Hoffman): There's a difference between something being like 99.9% private and 100% private.

Guest (Sean Bowe): We don't want to bend the knee on the privacy stuff. It would compromise our values.

Host (David Hoffman): What parts of Zcash are still quantum vulnerable today? And what's the plan for fixing it?

Guest (Sean Bowe): There were three big pillars of this. The first one is quantum recoverability.

Guest (Dev Ojha): There's this element of the tachyon privacy design that was shippable today for Near Intense. It's now shipped today in some of the wallets.

Host (David Hoffman): Yeah, I don't know who the whales are because it's private. Privacy gives you a lot. You cannot fish someone's wallet without a viewing key so easily.

Host (David Hoffman): It really matters what the Zekholders think. Zekholders are the lifeblood of the project.

Host (David Hoffman): Bankless Nation, I'm joined here with Sean Bowe and Dave Oja. Sean is a Zcash co-founder. He's been working in Zcash since 2015 and is the lead developer at Tachyon, which is an effort to overhaul how Zcash works, something we'll get into shortly. Sean, welcome to Bankless.

Guest (Sean Bowe): Yeah, thanks for having me. It's awesome.

Host (David Hoffman): Dev is a longtime ZK researcher, co-founded Osmosis, the biggest DEX in the Cosmos ecosystem that works on Zcash, trying to scale private transactions and quantum resistance, also something that we'll get into shortly. Dave, welcome to Bankless.

Guest (Dev Ojha): Thanks for having me.

Host (David Hoffman): You two have come recommended to me as two of the smartest people in crypto who have both gotten nerd sniped by Zcash. So maybe let's talk, let's start there. Why work on Zcash? Why is Zcash important to you? Sean, maybe I'll just start with you.

Guest (Sean Bowe): Well, I guess I was nerd sniped like a decade ago. So I've been working on Zcash since the beginning. I was like a huge Bitcoin guy in my teenage years. And I always knew that Bitcoin had major privacy flaws that were going to be eventually fixed with cryptography. And so I wanted to make that a reality in Bitcoin and then gradually saw that that was never going to happen in Bitcoin. And then when a lot of interesting new cryptography papers came out, which actually made it possible for this to happen in blockchains in general, I was really excited about it. I was kind of waiting for it. And I got accidentally, accidentally got a job working on Zcash. So I was really lucky.

Guest (Sean Bowe): I guess in the beginning of my obsession was with the cryptography and I also have like a philosophical attachment to privacy, a moral attachment to it. So that's important to me. Over the years it's been fascinating that the cryptography has remained really interesting. Despite the fact that in cryptography, the fact that we can go a decade and there's still new papers coming out every month or every couple of weeks that make things a little bit better or kind of surprise you a little bit is actually really exciting and awesome. So I really like the math. But also just the project has become incredibly important for privacy for many years. It was the only real project in the entire blockchain world that was actually trying to do privacy and doing it at a great personal risk for some of our developers. There's always this crushing threat of regulatory escalation and everything else. And so the fact that we kind of persevered through that, and now we're doing really well, that's also really exciting and awesome. And we're growing as a project. People like Dave, for example, it's just a really exciting time for Zcash.

Host (David Hoffman): Yeah, Dave, I'd love to hear from you as well about what motivates you to work on Zcash so strongly. Again, like I said, you guys have come highly recommended to me as people who are relentlessly mission driven and zeroed in, locked in on Zcash and privacy. So Dave, what motivates you so hard?

Guest (Dev Ojha): Yeah, what got me into cryptocurrencies, like this is a space that's really worth assessing over, was first actually learning that, oh, we can have... I did my first like, bank check. I was like, what the fuck? If you just know these numbers, you can like strain my ballots. And then I was, and that's how I know cryptography. I'm like, we have this whole cryptography system. Oh, that's what Bitcoin's doing. Bitcoin's using digital signatures to go protect all this stuff. Well, okay, that's cool, except that you know my public identity. That's kind of crazy. I deeply care about privacy. So once I learned what Zcash, I'm like, it's actually the first crypto coin I ever hold. Yeah. This matters for solving privacy for the world.

Guest (Dev Ojha): Then I learn about proof of stake and all these other problems for how we make blockchains usable, like IBC and Cosmos land. Like, okay, we need to have, in order for this to go anywhere, we need to start having chains be able to communicate, et cetera. So I spent a lot of time doing Stark work with one of the Zcash scientists, Salisandro Keza, learned a ton from him, and then work on Tetherman to scale proof of stake and make cross-chain communication happen and possible. It's like, I don't think stuff's going anywhere if you can't toggle cross-chains. There's not going to have one monolith that solves it all.

Guest (Dev Ojha): Fast forward a few years, it's kind of DeFi summer, and we realized that, hey, one of the big problems, we have three big problems in crypto in 2020-ish. Scaling, proof of stake is mostly solved, solved, and privacy. So we found this chain that's actually trying to tackle privacy for MEV. And the initial roadmap and goalposts is actually quite like Penumbra of do private holding things and do threshold decryption to solve a bunch of like MV risk. And then, you know, things start getting carried away, gets caught up in DeFi land. Turns out the whole privacy side roadmap was never really fulfilled on. But except that was the part that got me excited. That was like, well, I woke up every day to like work on the thing.

Guest (Dev Ojha): Things then come last year. Okay, we're going to repivot everything to fully privacy early last year. And then there's this big problem. How are you going to make a privacy system that scales and goes anywhere? And I've always followed and loved Zcash the whole time. First coin held. Friends of many people from the era of four or five years ago. And all the research. I ended up meeting Sean and it's like, oh, whoa, okay, this is considered an effort to make this win and make this succeed. That's... Let's join forces and make it happen. So I think it's the best shot we have for privacy winning.

Guest (Dev Ojha): Also, I was really inspired by every time Zcash made a technical decision, the rest of the industry copied it, even though when they're copying, if you're alert to what's going on, you'd obviously do something different. So it's like, oh, okay, Zcash sets the way. This is namely Ethereum. When Ethereum was doing its first pairing stuff, Zcash had switched from one curve to Southern one called B12381. Who cares? When Ethereum was going to go do stuff, it should have obviously done 12377. Now, they didn't just because Zcash did it. Oh, it's kind of inspiring. Yeah. Then you suddenly see a bunch of people start saying they care about privacy, who I was on calls about six months ago pitching stuff like, well, we're doing it. No, no one cares. No one, this will never matter. I was like, oh, wow. Okay, so Zcash succeeding is also inspiring for the rest of the world to care about privacy in a way that other things aren't.

Host (David Hoffman): Yeah, I don't think any Bankless listener is naive to why privacy is important. We've covered the topic of the importance of privacy a handful of times, probably primarily with Zuko, but a number of other guests. But I want to ask you guys about why privacy might be urgent in 2026. Because if you asked me when I first got into crypto in 2017, we're like, oh, yeah, privacy is going to become a core pillar of the industry. And we are all going to have financial privacy very quickly, soon after proof of stake. And not only did proof of stake not really come very quickly, but neither did privacy, with the exception of Zcash. So Sean, I'll ask you guys about this, but I'll start with you, Sean. Like, what's your case for why privacy is urgent these days?

Guest (Sean Bowe): Yeah, so, you know, it used to be that when you used a transparent blockchain ledger to transact, if you're just a normal person, you weren't really worried about the fact that these chain analytics firms existed who could basically track everything that you do. Associate all your transactions together, figure out your online activity based on that, for example, because you weren't really a real target. I was worried, but most normal people weren't. And hackers and thieves were always really nervous and careful about using these things. But now with AI, obviously, a teenager just with access to an LLM, basically, can identify and track everybody using these things. So everyone using crypto. So when you use a transparent ledger now, even if you're not a thief or a hacker or a criminal or any of that, you should be actually really nervous.

Guest (Sean Bowe): In the coming years, I think it's going to get much worse. It's going to get so bad, in my view, that you will have these just public databases, these free public databases that have completely mined the blockchain of information. Where every single individual who's been transacting on public ledgers has been quantified and tracked in every possible way. And I think with this sort of AI resurgence, I think that's why privacy has exploded. It didn't just gradually get better. It kind of exploded over the last year. And that's why, because I think a lot of people paying attention actually realize that this is serious. We need to get away from these transparent ledgers like right away.

Guest (Dev Ojha): Yeah, the follow-up problem is it's not just your blockchain transactions. It's also every other data leak that in the world compounds. Each Coinbase transaction exchange leak. Oh, that's your address that gets tied to all this. It's not just your physical address. It's not just there's one human in the world who has this much of a balance. So, yeah. I think the problem's always been bad. It's just not many people had friends at Chainalysis to see how bad it was. And now you don't need a friend. You just go type one sentence into Claude or just see the breach of the day to understand.

Host (David Hoffman): So in myself and also a lot of listeners probably are very familiar with Ethereum's swim lane roadmap. I'm wondering if there's something like that as scaffolding for knowledge for understanding the rest of the Zcash roadmap, because that's really what I'm looking to understand here with you two, having the opportunity to talk with you guys. How would you guys categorize the work left to do on Zcash? Like what are the broad categories that all the work kind of fits into?

Guest (Sean Bowe): Well, I'd be curious to see how Dave would categorize it, but I would, I guess there's, in my mind, I think there's three camps or three categories. There's the cryptography side. So there's trying to make the cryptography more secure and more efficient. There's the consensus protocol. So the networking side of things, making that scale. And then there's the wallet side of stuff. So making wallet scale and giving them good UX. I think those are probably... And then Dave can speak to the last problem. I think it's actually the most challenging problem. And he's actually... That's kind of why I'm really bullish on Zcash is because he's actually most likely to solve those problems.

Guest (Dev Ojha): I kind of think of it in high-level goals of get scale, harden the chain, and then ensure full economic sustainability, where the latter is almost a minor detail, but I feel it's not one of the other two, actually. Now, scale, in my head, encompasses several things, which is, this is maybe a user-facing map of these are three properties to expect. But to hit scale, you need a ton of stuff for wallets. And then you need a ton of stuff in consensus, like make high throughput proof of work for the first time ever. And you need cryptography advancements, like recursion and Tachyon, and all sorts of fee market updates, getting this into making an aggregated mempool, et cetera. Then the second one is hardening, is a bunch of privacy improvements, getting increasing security numbers, bits of numbers, post-quantum, do you go multi-assumption, formal verification, supply chain, etc. And the last one is economics.

Guest (Dev Ojha): Well, today there's a bunch of services that you expect people to run for you. If you take Ethereum or Solana Wallet, RPCs are paid for by the wallet, like by Phantom Company or MetaMask Company. And they do some stuff to ensure you're not spamming a bajillion wallets. And they expect to make money off you when you go swap one day. In Zcash, there's no tracking of the users. So then there's a couple of entities who provide these services for free for requesting data. It turns out that in order to make Zcash scale, those guys have to do a lot more work over time. But then we also don't want to have them able to track you. So we want to have a way for the user to pay the RPC providers, but break any sort of tracking link. So we need to build some sort of private subscription service so that we're not relying on altruism. Or what, I think the most altruism is that it ends up being a centralized foundation or nation states. So we don't want that. So user has to pay properly to get a proper market and have no identities.

Host (David Hoffman): You can spitball some answers for us, but there's a difference for, it hasn't actually been deployed and real. So as I'm kind of learning about this, hearing you guys, a lot of this stuff feels very familiar to me. Like we need to scale the chain. We need to get over the quantum hurdle. The thing that feels uniquely different about Zcash is the relationship with the Zcash protocol and the wallets that use Zcash for privacy. That doesn't seem like it has any corollary to Ethereum or Bitcoin or any other project that I'm familiar with. Because, and I think it's the privacy variable that really makes this true. Whereas if you want to use a wallet while also maintaining privacy, there's just some extra considerations that need to be made to preserve the notion of privacy. And that creates new engineering challenges that is unique to Zcash. Is my understanding correct here?

Guest (Dev Ojha): Yeah, absolutely. I put it in two buckets as well. Scaling privacy for wallets is a fully unique challenge and actually it's harder than scaling a chain. And then scaling the... And then, yeah, how do you architect the chain to be more privacy aware? I think that's a little bit easier of the two. Actually, one of the brilliant things of Tachyon is early in Zcash, these are really coupled. A lot of the things you need to be private and make the wallets private and wallets standards is baked into the protocol. One of the cool things attacking was actually these get unbundled and it's a lot of just... I don't know how you frame it Sean, but in my head it's like we learned how to make ZK way faster so we didn't have to bundle these things for the last 5% of efficiency.

Guest (Sean Bowe): Yeah, I think that we also bundled them for weird reasons. For example, addresses. We early on in Zcash, we wanted to address this to be as small as we could. And so certain keys that were in the addresses needed to be used both for the wallet facing side of the stack, so for the private transfers of information over the chain, and then the others just for the custody and spend authority stuff. And so those got merged together just to make these addresses small. But of course, now we live in the kind of post-quantum world where the addresses are going to get really large. And so we need to solve that problem anyway. So it's kind of just it turned out to be a pointless engineering architecture that we've learned from that.

Host (David Hoffman): So I want to drill down into each of these three different categories. Both of you gave me three categories. And while doing my best to make sure the layman can kind of, you two are both very technical. I'm trying to do my best to get technical answers out of you that are still accessible to the layman. Before we start down those paths, those three different paths, are there any overarching principles or philosophies that guide Zcash development broadly? Like something like in Bitcoin, for example, all Bitcoiners will say everything about Bitcoin is a means to an end to preserving 21 million units. That's an architectural philosophy that Bitcoiners have. Is there anything, is there any lesson like that in Zcash? Sean, I know you've used this phrase, ledger indistinguishability before. Maybe that is something to talk about. But as developers who are writing code, and as all cypherpunks know, code is imbued with values. What philosophy can you share as just like lessons for me and the listeners about how Zcash is built?

Guest (Sean Bowe): Yeah. So definitely the one philosophy that I think is ingrained throughout Zcash, if you wanted to pick one, is kind of a maximalism on privacy. So in our shielded pools, we go as far as possible when it comes to privacy. And that's the thing that you were mentioning about ledger and distinguishability. So ledgering distinguishability is basically this academic term. It's just a way to, like, if you say that something's private, like say blockchain transactions are private, what does it actually mean to say that? Ledgering distinguishability is a way to quantify or study that. So the way cryptographers do that is they kind of create this game where your adversary is trying to distinguish two transactions from one another. So they'll have a transaction from you and have one from Dave and want to tell them apart. And if they can, then it's game over. And so that's a really, really strong property because it means that the transactions have to look like just random data basically in order to win that game.

Guest (Sean Bowe): All this privacy tech that exists in every project, like stealth addresses and ring signatures and stuff like that throughout the crypto world, those can help in certain situations, but fail that game easily. And so we've been really hardcore about making sure that we've proven and now formally proven to some extent these security properties like ledger and distinguishability for these shielded pools that are in Zcash. Now, is it like a hard and fast rule for Zcash? No, because we have transparent addresses. And there's other kinds of considerations. And so we take a practical approach to it. But I guess the other part of that is that we also don't want to add any sort of concept of like a backdoor or any kind of viewing capability for a regulator or any kind of anything like that. A lot of projects that have dabbled in privacy over the years of 2020 have entertained these goofy little... entertained bending the knee. We don't want to bend the knee on the privacy stuff. We don't need to. It would compromise our values. And so we don't even entertain it.

Guest (Dev Ojha): Yeah, I think that's what a lot of people get excited about Zcash about. Going back to the first thing you said, with the ledger indistinguishability and just a full commitment to privacy, just to illustrate that point a little bit more, there's a difference. I think what was something, another way to say what you were saying is like there's a difference between something being like 99.9% private and 100% private. And if you go back and just look through the arms race between cryptography and cryptography breakers, cipher, cryptanalysis, I believe is the word, is that all weaknesses of any sort of cipher ever is that it leaves traces. It leaves a trace somewhere. And if you leave enough traces, then somebody can Sudoku puzzle their way back into breaking the cryptography and the arms race continues. So maybe, Sean, is maybe another way that what you're saying is that we're not going for 99% privacy. We're going for 100% privacy.

Guest (Sean Bowe): Yeah, in cryptography, there's always these known unknowns and unknown unknowns when it comes to whether if you leak a couple bits here, you can kind of just... and gesticulate, say, oh, well, whatever, it doesn't matter. We can't think of an attack. Cryptographers know better. They say, okay, well, that's probably going to come back and hunt us, even if we can't think of an attack now. But actually, when it comes to blockchain privacy, we actually know about all of the attacks or most of the attacks that you can perform if you only have this really good privacy, but not 100%. Like there are these attacks, for example, called set intersection attacks, where if you're trying to identify the source of money and you have somebody using a protocol which anonymizes them amongst a large group of people, even a very large group of people in each transaction, then all you need is two transactions from your target in order to very quickly eliminate anyone except the actual target as being the source of those transactions. Simply because you leak way too, leaking anything at all in one of the transactions immediately breaks everything in the other one.

Guest (Sean Bowe): And we've known about this for a long time. Cryptographers have known about this. In fact, this notion of ledger and distinguishability comes from, I don't know, 12 years ago or something like that. In the zero cash paper, zero coin paper, whatever it came from, where they were actually trying to be more rigorous about what does it actually mean for an adversary to be able to break your privacy. You needed that in order to actually eliminate these kinds of set intersection attacks and stuff. So we actually know about the problems that are going to come back to haunt us. Most of them, not all of them. And knowing about them is the first step, I think, to just pruning them away from Zcash, which is what your job is, Sean, right?

Guest (Dev Ojha): Yeah.

Host (David Hoffman): Dave, anything to add about the philosophy behind Zcash?

Guest (Dev Ojha): Yeah, maybe I just restate a little bit simply of... maximize privacy of don't take a shortcut. And so on the chain side, you went for the best known, the best you can get since day one. And now the principles only expand it further and further where, hey, it turned out the RPC side was always hard. So now we're bringing in solutions to keep improving that. So don't settle for any known distinguisher I think pre-core one. Another one is we inherit a bunch from Bitcoin. 21 million hard cap that shouldn't change. Proof of work.

Host (David Hoffman): Is proof of work built into the Zcash culture?

Guest (Dev Ojha): Yeah, so there were some moves to push back and change it or add more to it. I think it's pretty solidified that the proof of work for the block awards is pretty central. I haven't seen any, and if you want to change it, you'd have to get miners on board and coin holders on board.

Host (David Hoffman): Interesting. That's something that will go into the long-term security plan for Zcash towards the end. Let's get into scale. Let's go into this first swim lane scale and Tachyon. First, just again at a high level, why is it important to scale Zcash at all? Why can't it just be like Bitcoin, which is to be a very decentralized, slow, constrained blockchain? Why doesn't that work, Sean?

Guest (Sean Bowe): We need it to scale because Bitcoin succeeded over the years because it got institutionally ingrained. Because millions of people started using it and it would upset a lot of people if you did something to harm it. So it was sort of a foregone conclusion. We want Zcash, I think, I want Zcash to end up in that same position where just like as many people hold it as possible and use it as possible so that it becomes ingrained like this and becomes harder to attack. And so that's one reason. I mean, there's many reasons, but it needs to scale the payment, the private payments need to scale in order to make that work at all. Otherwise people would just use some other tech. And that's really the simple answer for me. It's not going to succeed if people can't use it to transact. If people were just going to use it to hold it, they could do something like that with Bitcoin.

Guest (Dev Ojha): Another way to think about it is like, do you have better anonymity in a system that has a thousand payments per second or one payment a week? Obviously a thousand payments per second. And so the limiting principle is, yeah, go get this to be as usable as cash.

Host (David Hoffman): So there's a one-two punch that I'm seeing here is that A, the job of being private is easier if more people are using it. The anonymity set there is larger. But also inside of Zcash philosophy, it's not just good enough to be a private store of value. It must also be a private way to do commerce too.

Guest (Dev Ojha): One of the most inspiring moments I had when meeting a lot of the Zcash team members for the last 10 years is we meet folks in some city. There's this dinner bill and a split of 11 people. And we have some very incredible people trying to split this by hand and calculate taxes or whatever. But then it was a bit silly. But then it was perfect peer-to-peer splitting using ZEC payments to each other or ZEC OTCs to USD to pay. Because there can be no credit card used and you have to use ZEC with the ZEC wallets. But it was awesome. I've been going to crypto events, I don't know, 10 years now. I've never seen people actually split up payments and using the real wallets at an event. Using this as currency is actually in the culture. Just kind of awesome.

Host (David Hoffman): That is cool. That is cool. And going into just the human rights and individual rights element. To me, this is like kind of encoding, hard coding in cryptography. The right to assembly, if you will, because of these 11 people with this payment, had you guys used credit cards, some authoritarian nation state could have said, like, oh, look, you guys assembled. These 11 people assembled, and in this dark authoritarian imaginary world that I'm creating, that's not allowed according to this oppressive nation state. And so removing the traces of data of people coordinating with each other and grouping with each other, that's the practical application here. Let's get into Tachyon, which I think is the first step into the world of scale for scaling Zcash. Sean, how do you explain simply Tachyon, what it does and how it scales Zcash?

Guest (Sean Bowe): So over the years, Zcash has had these different shielded pools. And like every few years, we've added a new one. And they've always tried to improve something like the efficiency or add features or whatever. People kind of gravitate toward the most recent pool. The most recent one was Ironwood, which we launched earlier this year. And the reason to gravitate toward that is that it was formally verified. The one before that, Orchard, was created because we wanted to remove the trusted setup, so we made it more secure in that sense. The one before that was Sapling, which we made because the zero-knowledge proofs that we originally shipped in Zcash were really, really slow, and you couldn't even use it on phones, and so we needed to use bleeding-edge ZK tech in order to make it possible. So we've been making these incremental advances in the cryptography, and that's what Tachyon is. Basically we're tackling the last areas where the cryptography holds scale back. And there's a couple places where it does this.

Guest (Sean Bowe): The first place is that proofs are large. And so if you want to put them in transactions, if you want to put more shielded transactions in a block, you have to deal with these zero-knowledge proofs. You have to aggregate them. So like in Bitcoin today, we're having all these conversations about scaling Bitcoin in a post-quantum world where you have post-quantum signatures that are much larger. So you have to think, not just in Bitcoin, but in Ethereum and everything else. So we're thinking, how do we aggregate these signatures together or these objects together so that we can actually strip them out of the transaction and replace them with a bigger one per block. That's basically what we're doing, except we have that scale problem already, even in the pre-quantum world, and it applies to our zero knowledge proofs, not signatures, but zero knowledge proofs. And so Tachyon kind of addresses that and it uses this thing called a recursive snark to do it, which is this fancy cryptography.

Guest (Sean Bowe): And there's this other technical thing that doesn't scale very well in Zcash today, where basically every transaction that takes place, every shielded transaction, adds or grows this set called the nullifier set. It grows it perpetually and you can't get rid of any of the data in it because you need it to prevent double spending.

Host (David Hoffman): Is this state bloat in the Ethereum world? This is state bloat?

Host (David Hoffman): Yeah, so this is state bloat. Like in Bitcoin or Ethereum or whatever, you don't really have this problem because you can go back through and just remove the old data. I mean, you can keep the old chain data as like an archive node, of course. But the data you need to actually validate new transactions is... only has to sort of scale linearly with the number of users you have, usually something like that, in most transparent blockchains, but in ones like ours that take the privacy seriously, you're basically screwed a little bit. You need a set that grows perpetually and Tachyon addresses that also with the recursive snarks. So we also use this cryptography to sort of compress these things. We're basically tackling these two parts of the scale problem for the cryptography so that the remaining scaling challenges that exist in Zcash are, I don't want to say just engineering challenges because they're really, really daunting engineering challenges, but it becomes like the lower layer of Zcash, the cryptography is out of the way. So we don't have to worry about that part of the architecture anymore. Everything above it needs to solve the scaling challenges, on the consensus protocol or at the wallet user-facing side of things. And that's sort of the direction that we're going with Tachyon.

Guest (Dev Ojha): Of the part of Zcash that Tachyon addresses, this isn't like block speeds or block sizes, which is kind of the traditional thing to talk about when we talk about scaling. This is talking about reducing the size and therefore increasing the scale of the shielded transactions part of Zcash. Is that correct?

Guest (Sean Bowe): The actual cryptography, the private payment cryptography that takes place on-chain, just falls apart with too many transactions, quite frankly. And so we need to fix that so that we can talk about increasing TPS. Massive blocks and massive TPS. Yeah, it's not even a conversation until we address those problems.

Host (David Hoffman): Right, yeah. So the goal is high TPS, high big blocks. First, we need to solve some dominoes earlier in the stack that allows us to have the resources to do the high TPS thing.

Guest (Dev Ojha): Yeah, Tachyon on its own is a scale upgrade. It changes the equation if you're a full node of today. Let's say you want to process a million transactions in a block. You have to go and verify a million ZKPs. With Tachyon, your job as a full node is now to verify one ZKP. That's pretty cool. Second is that, oh, a million transactions would cause a million units of state forever. Okay, the state is now gone with Tachyon. Now it's literally, if people are familiar with a lot of the 2017, 2020 discussions of stateless blockchains, Zcash is like, achieve what they're all talking about with the stateless blockchain. You've got some state for the last month or so in a live full node, then everything else is like this historic state that you can trustlessly query, need to go use, but it's not in the full node itself. So Tachyon brings both of these and the first one is already like a 5X plus scale improvement on day one.

Host (David Hoffman): This is starting to remind me of just ZK rollups in Ethereum land. You have a bunch of transactions, you roll them up once with a ZK circuit, and then you roll it up again with another ZK circuit and you post the proof to the Ethereum layer one in the blob space. The pattern sounds pretty similar. Is that about right?

Guest (Dev Ojha): Yeah. Credit to Ethereum for doing a bunch on pioneering deployment of recursive ZKPs. It's the same thing. The same thing is going on for the first part. And the second part of going stateless is like a net new for the first time ever thing that Sean came up with.

Guest (Sean Bowe): Yeah, so there was this paper that I wrote with Ian Myers last year where we detailed this technique that I don't want to take all the credit for, but where we detailed this technique that's kind of novel that allows you to combine the recursive proofs with this other trick to make it possible to do so.

Host (David Hoffman): And then also with statelessness and just reducing the size of bloat, minimizing, eliminating the size of bloat on the ZK blockchain, doesn't that just also make the blockchain itself more permeable across the internet in the sense that smaller devices can manage and take part in the Zcash blockchain? Is that right?

Guest (Dev Ojha): Yeah, this depends on what your goal is. Are you building a blockchain where you want a Raspberry Pi to be a full node? I think the Solana folks were actually entirely correct on this side of the trade-off. If you want a Raspberry Pi, you're not getting scale. You're not going to be, in Solana's case, you're not going to be a decentralized NASDAQ. That doesn't make any sense. In Zcash's case, no, you can't shove 50k TPS to a Raspberry Pi, even if you want it. Because at some limit, there is a bandwidth problem. How much can you process in a Raspberry Pi? 10 megs, 100 megs, et cetera. But it does drop the requirement of, okay, maybe you don't need a petabyte of SSD. You just need a couple hundred gigs of SSD. So Zcash isn't on the side of the spectrum of Raspberry Pi full nodes. I think everyone's on board with, look, you want to be a payment system, that's not going to work. But okay, let's do a bunch to maximize it under being reasonable.

[Ad break for Ripio and Vizor]

Host (David Hoffman): Is the Tachyon conversation the entire conversation around scaling around Zcash? Or what else is there that's not included in Tachyon with how to scale a blockchain?

Guest (Dev Ojha): So Tachyon changes the cryptography side to make the scaling equation. As far as the blockchain is concerned, hey, every transaction is two kilobytes. Okay, you want 50,000 transactions per second? Go build me a blockchain with 100 megabytes of consensus throughput. So then you have one whole new branch of how do you build a blockchain under proof of work that can achieve 100 megabytes per second of throughput. Then you have a second part of the equation, which is unique to privacy, which is how do you build a private wallet that can discover when it gets paid without downloading all data on the blockchain? I think people often spend a lot of energy trying to understand Zcash on how the zero-knowledge proof works, which is really cool. But the second question that people should understand, which is why has Zcash UX taken as long as it has to deliver or be usable, is the hard problem is how do you figure out you got paid? An anonymous payment is one where no one knows who it's from, who it's to, or how much is in it. So then how can your wallet go ask a server, hey, what's my balance? Right, because it's a private blockchain. How does a wallet know if the blockchain is private? So the solution that's been done in Zcash up until very recently is you're going to go download every single transaction history and test, was this a transaction, a payment to me? Yes, no. But that can't scale. Because if the blockchain is doing 100 megs a second, you'd have to go download 100 megs a second. That doesn't work. So there's this really cool new line of cryptography that basically had a breakthrough 2022-ish. But it's only really usable now. It's called Private Information Retrieval. And it's this huge work to say, instead of go download a terabyte of data, instead go do a query to a server. The server will operate over a terabyte of data and give you back an answer, but the server won't learn anything.

Host (David Hoffman): This should feel a bit like FHE. Somehow I can encrypt some data, go talk to a server, the server does some stuff on the data, gives me back an answer, and the answer is useful for me. And I feel like FHE because it literally uses homomorphic encryption under the hood. Because it is FHE.

Guest (Dev Ojha): Yes. So it turns out for this precise use case, there were breakthroughs and tricks that makes it very fast to do on a server. It turns out you can transform this problem into just a big matrix vector multiplication. And it turns out that, hey, our friends in the AI world have made big matrix vector multiplications very cheap and usable for us. Go have someone buy an H100 and go service for all of us. So these two things have come together and the cryptography side invented this. And AI land has really optimized GPUs to make this a viable world. And so that's where we're going with the wallet side to make that scale. And Zcash has already deployed this PIR stuff. We just had a coin holder vote where we used it for the first time, I think, in any cryptocurrency project has ever used PIR. We used it less than a couple of months ago.

Host (David Hoffman): How does this not introduce a centralized third party, however? If we are querying a server... Okay, I get that with FHE and the advancements in GPUs and processing power, that I will be able to remain anonymous because that's what the math does. It keeps me anonymous. But nonetheless, I'm querying a centralized server. So how does that not turn into a trusted intermediary that arbitrates my relationship to Zcash?

Guest (Dev Ojha): So there's two parts. One is kind of like RPCs. Take Ethereum, right? You have to go talk to one RPC provider. Now, it's permissionless to go make a new RPC provider. Just go download a new copy of the chain and go index it yourself. And there's multiple providers already there. There's Alchemies, there's Infuras, et cetera.

Host (David Hoffman): Apologies to all the other dozen plus providers.

Guest (Dev Ojha): Yeah, but there's a lot of options. So same thing as Zcash, there'll be a ton of options. And there should be a market incentive where you can pay the providers you have anonymously. So you can anonymously pay the providers so that you can access it. And if for some reason you're being disenfranchised, there's not a reachable one, okay, go spin up a new node to the blockchain with, admittedly, a lot of bandwidth capacity. Sync it up and start serving.

Host (David Hoffman): Okay. I would suppose that the paying of the Alchemy, the Infura, the RPC provider is also a privacy engineering challenge that is somewhat difficult, but you, I would assume, think it's overcomable.

Guest (Dev Ojha): Yeah, I can even sketch how you overcome it. The verbal sketch is basically, okay, in Zcash, we've got this trick for preventing double spends. If I want to go pay an RPC provider, I basically need to prove to you that when I go do a query, hey, I've got an active subscription to you, and my subscription has given me, let's call it, 10 requests per second. And then, hey, look, I'm not using more than my 10 requests per second. So what I could do is I can make 10 one-time tokens for every different second. Or let's be more practical. Let's say I get 1,000 requests a month. So I can make a thousand different one-time tokens. Every time I do a payment to you, I use the same technology I use for my private payments for proving no double spend to prove, hey, I'm burning a new token each time. And it's a valid token that you, the server, have authorized. Now, you, the server, don't know which of your million users is using the subscription, but you can authenticate that, hey, it's a real subscription. The engineering problems, there's two engineering problems. One is how you do this for the first time if you're onboarding a user. If I'm giving you your first sec, well... Okay, you've got a wallet. You've got to go pay the wallet. So am I the one paying for your subscription? You can imagine a world that looks a little bit like Solana's state rent, which is that every unit of state you have requires a minimum SOL balance. You don't get deducted, but it must be some minimum. Maybe you can imagine a world where we architect the wallet UX like that. The second problem is just that when you go to do it engineering-wise, hey, if I'm doing one payment, I might need to have done like 10 queries in the background. Okay, am I doing 10 Zcash grade ZKPs in the background? That's kind of a lot. That's the verbal sketch I just gave. There's tons of engineering tricks to improve that. Someone's got to go dedicate a couple months to bring that to reality. That's a solvable problem.

Host (David Hoffman): Okay, so this is the two halves of Zcash scaling. There's the actual cryptography that's in the protocol on the blockchain that leans up the blockchain, makes it seem super sleek. I'm getting that image of the SpaceX engines. They start kind of complicated with wires everywhere. They end up pretty simple with very few moving parts. Kind of feels like that. Makes the Zcash blockchain, the cryptography, very efficient, very fast. That creates a problem. It makes the wallets need to be really smart with how they keep up with all of the data going through the blockchain. But that's what Dev said with the FHE on the server, with the RPC that we just covered. You put those two things together and you have a very fast scaled Zcash.

Guest (Dev Ojha): One more ingredient, which is scalable proof of work.

Host (David Hoffman): I was worried about that.

Guest (Dev Ojha): Yeah. So it's three ingredients. You got two perfectly. The third one is just that Zcash as a blockchain today processes about 60 kilobytes a second. In order to do a 50k TPS with the glorious Tachyon feature, we need 100 megs a second. Okay, well, we're going to have to do a bunch of engineering stuff to go get us from 60 kilobytes to 100 megs. Step one is happening in like two weeks of just drop block times and keep the same block size. That's a 3x increase in bandwidth, so 60 kilobytes to 180. But then do a lot more of that. Start erasure encoding blocks, just like everyone was talking about 2017 and Solana does right now. And Ethereum does for the blobs. Start doing that. Start just using more sophisticated gossip methods, similar to how Celestia does it as well for their fiber stuff. And you start seeing that, hey, 100 megabytes is actually really viable. There's one other problem, one other aspect to it, which is that proof-of-work block times are super variable. I don't know if a lot of people have really forgotten this problem since ETH merge. When Zcash goes to a 25-second average block time, 1% of blocks are going to be super fast, 250 milliseconds. So 100x faster. And then 1% of blocks are going to be super slow, like over 110 seconds. So 4x slower than normal. So the trick is going to be, over the next two years, how do you maintain high throughput while keeping the security as the single chain proof of work assumption that's very familiar? And it turns out there's tons of tricks over the different trade-offs. It's going to be, how do you pick which one is right for Zcash? It's just going to be fun, community discussions. It'll be a pretty straightforward path to get to one to 10 megs per second of throughput. And then the 10 to 100 is going to be, okay, time to introduce something net novel that the whole community features trade-offs. But while remaining single chain proof of work.

Host (David Hoffman): I'll admit, I never in my time in crypto did I ever think I'd be nerd sniped by something related to proof of work. That is a new hurdle for me. I think this whole block time variance thing is like we've all forgotten the pain since Ethereum moved off PoW.

Guest (Dev Ojha): Right, right, right.

Host (David Hoffman): Okay, let's wrap up scale and move into hardness because this is kind of the other very big swim lane when it comes to Zcash. I think maybe let's start with quantum because that's the very sexy, very fun topic to talk about these days. Broadly, what's the roadmap for Zcash to become post-quantum? What parts of Zcash are still quantum vulnerable today? And what's the plan for fixing it?

Guest (Sean Bowe): We did this video back in, I think, April or something where we outlined this kind of roadmap for post-quantum cryptography and Zcash. And there were three big pillars of this. The first one is something that you've probably heard about if you follow Zcash discussions on social media. It was called quantum recoverability.

Host (David Hoffman): Yeah.

Guest (Sean Bowe): The idea behind this is, do I have some money in the shielded pool? And then all of a sudden quantum computers show up. Can I get my money out? That's, can I recover my funds? So if we add that to the protocol, it gives us this buffer room or this leg up over an attacker or rapid advances in the cryptography. And then it also allows us to feel more comfortable once enough people have moved into something that supports quantum recoverability that we can carefully and deliberately build more post-quantum tech in Zcash and people can gradually move over to that without worrying that people have to mass migrate all of a sudden, otherwise they're going to lose their money. So that's the first pillar, and we've actually achieved this in Zcash. So we were talking about it in April. It's now live in Zcash as of a couple months ago. So if you have funds in a shielded wallet in Zcash, you probably have them inside of this new shielded pool, which supports this. So great. So that's one step in the right direction.

Host (David Hoffman): So that assets in the terminology of Justin Drake are in their bunker. The ZEC in the new shielded pool are inside a bunker mode. And we feel okay about that.

Guest (Sean Bowe): Right, and you don't have to do anything. They're in the bunker, so to speak.

Host (David Hoffman): Today, you can just go hide your wallet somewhere, come back 10 years later, and you can spend it.

Guest (Sean Bowe): Yeah, that's a simple explanation. Okay, so the second pillar is privacy. So right now, like Dev was saying earlier, if you want to receive money in Zcash, you basically scan the whole blockchain and try to figure out which payments are to you, and that's done using pre-quantum cryptography because it's quite small. So we need to remove that and replace that with post-quantum cryptography. Doing that as part of the tech is one of the elements of the Tachyon shielded pool. So Tachyon is going to solve this too. Tachyon is decoupling the cryptography from what the wallets use so that the wallets can use post-quantum key exchange stuff like ML-KEM stuff. After that's done, it's fully post-quantum private. Now today, Zcash actually has some elements of post-quantum privacy. So we have actually been thinking about this post-quantum stuff for a very long time. The protocol, like certain adversaries and in certain situations, it's already post-quantum private today. Like if you don't give your address out publicly, then your adversary can't de-anonymize or study your payments on chain. So if you keep your address private, but we're extending this to the whole thing. Another aspect that we've been sort of thinking about for a long time, actually quantum recoverability. I believe we started building that as a community. The first specs were being written back in early 2025, I think. So that was a long time before everybody started panicking over quantum stuff. So we were working on this for quite some time. The last pillar is post-quantum soundness. So basically everything, once you switch that over, the cryptography cannot be attacked at all by a quantum computer. And we're completely done. So today, a quantum computer could show up and counterfeit Zcash by attacking a shielded pool. Once it's post-quantum sound, they can't do that at all. And those are basically the three areas that we need to roadmap. What's been kind of cool is that we discovered a bunch of intermediate ways to ship more of this since that first April thing as well. So we got the quantum recoverability fully through. On the privacy side, it turns out there's been additional boosts. So the Zcash Near-Intents integration now is actually 100% quantum unlinkable, which is a new privacy step before we get to Tachyon.

Guest (Dev Ojha): Sorry, it's quantum unlinkable and supporting wallets who use some PIR features, like ahead. But we can get that.

Guest (Sean Bowe): Well, what happened there was it turned out there's this element of the Tachyon privacy design that was shippable today for Near Intents. So great. It's now shipped today in some of the wallets. Similarly, on the post-quantum soundness side, okay, why is this harder for Zcash than every other chain? Well, we're going to have to go from these elliptic curve proofs to these post-quantum recursive Starks. So a lot of engineering work going on. And Tachyon is... Every time you achieve recursion, it's a very big deal. It's actually an incredible technical feat for Starks. People should be proud of. So it's being done with the elliptic curves using very clever tricks to make one of the most advanced achievements there. But Tachyon, and we have to go adapt that to Starkland. But we can bring the post-quantum pool, sorry, the transparent pool to being post-quantum much earlier. Similarly, you can also ship the quantum recoverability code much earlier as well. So what you should see is that, hey, early next year you can now have fully post-quantum transparent transactions. Maybe mid next year you can demo that you can run the full path for, hey, if a quantum computer appeared tomorrow, we freeze elliptic curves. You can see in real time that, look, the chain will let you do it. You will go from a shielded pool to post-quantum transparent. It's there. So if we freeze the chain elliptic curves, you still have access to funds is never lost. And then the final step of, okay, we've achieved the full post-quantum recursive Stark pool.

Host (David Hoffman): So it sounds like there will be a moment where the entirety of the Zcash system is post-quantum, but the path getting there is actually incremental rather than specific, there's not one specific day. What are, maybe we could just trace over the actual big milestones for the big increments that happen between now and a fully post-quantum Zcash. Like what are the big flags that listeners should know about that are coming down the pike for Zcash?

Guest (Dev Ojha): I think the biggest one is that quantum recoverability is live. And then post-quantum privacy should be fully live with Tachyon. Or Jan next year. So Tachyon is a very big milestone for Zcash in this step towards being post-quantum. And to understand that, once you have post-quantum privacy and quantum recoverability, there's not that much to worry about. Some base level of trust of like, hey, the Zcash community, when they see a credible quantum threat that quantum's coming tomorrow, they'll proactively freeze elliptic curves. If you believe that link, then you have just kind of not anything to worry about. And a lot of the quantum paranoia, I think, comes from a bit of not understanding how does attacking cryptography work in the world of... Let's say you had a magic quantum computer in your pocket right now. You're not really going to be able to break every single key, every single thing right now. You'd have to have exclusive access to that and not leak anything to the rest of the world for a year plus. And then even more than that. And then Zcash is probably not my first target. It's probably a little bit further down the line after I take Satoshi's coins and also hack all of China.

Guest (Sean Bowe): Yeah, and with Zcash, one more thing on top of that is that you would also need, you don't have an easy access to know the balances. Are you just going to randomly check every address? You can't just target the whales because you don't know the whale's address.

Host (David Hoffman): Right, I don't know who the whales are because it's private, right?

Guest (Sean Bowe): Right, right. So there's some level of bunkerness that Zcash has implicitly based off of the nature of what it is.

Guest (Dev Ojha): Yeah, privacy gives you a lot. Maybe this is a tangent, but a lot of these phishing attacks depend on knowing what transaction to construct to steal your funds. That on its own already needs a viewing key, which is hard to get in Zcash. You cannot phish someone's wallet without a viewing key.

Host (David Hoffman): So that's the quantum side of the equation. But we're also recording this right in the middle of like the internet apocalypse, like Black October. A couple of weeks ago, Justin Drake had that tweet about, hey, it's time for bunker mode. And this wasn't because of quantum. This was actually just because AI models are getting so good that more classical tricks are becoming valid for breaking systems. So what do we think about this? Just AI math getting so competent that aside from quantum, it starts to poke at or threaten cryptographic systems like Zcash. Sean, does stuff like this worry you?

Guest (Sean Bowe): I guess the thesis here was that it was two things. One is that AI advances might attack classical crypto, and I haven't really seen a lot of examples of that. The other is that it might compound advances in quantum computer development and things like that. So I think that was a lot of the worry was that, oh, this stuff is accelerating. So whatever concerns you had about switching to post-quantum crypto before, you should probably be more worried now. I think that's like the generous takeaway from the bunker mode kind of panic stuff. I think Ethereum is sort of hitched its technical identity a little bit to some of this new cryptography because it resonates with the market. And they've invested a lot into this stuff over the years and the cryptographers and engineers and stuff that worked on it. So they have kind of an implicit leadership position in that right now. And that can be abused a little bit because you can... I think that's a little bit what Justin's doing here is he's kind of taking advantage of the fact that they have that kind of leadership role. And you can be more and more doomer and try to push the Overton window a little bit and kind of get away with it because the people on the other side are just like denying the threat entirely of AI or quantum computers and stuff like that. And they look silly. So I think Justin probably ran into the extent to which he can be a doomer without looking kind of ridiculous. That's just my personal view.

Host (David Hoffman): What about the subject of formal verification, just to give Zcash longer-term, stronger, harder assurances about the hardness of the whole entire system?

Guest (Sean Bowe): We have been working on... So with Tachyon, we were already writing, doing formal verification of Tachyon because Tachyon is actually using more esoteric cryptography. So like a year ago, we had already set up contracts with these formal verification people to help us build this stuff and integrate it into our cryptography stack. And so we were already kind of ahead of the game on that.

Guest (Sean Bowe): Then this Orchard counterfeiting bug was discovered. And so we needed to basically rule out that it was impossible for any more counterfeiting bugs to exist. And you can do this with formal verification. Like we can mathematically prove that there are no undetectable counterfeiting bugs in the protocol anymore, inside of the shielded pool. And so we had this massive month and a half long or two month long sprint to prove that, to formally verify it. And we pulled it off and shipped this upgrade.

Guest (Sean Bowe): I think it's been hugely inspirational. I've heard from every project in the crypto world. They've messaged me and said, how are we going to do this for our protocol? What did you guys do? How did you guys do this so quickly? It really matters, especially if you're using this tech, even if you aren't, but especially if you're using this ZK tech. There's so many ways to screw up and the damage is incalculable. So us being ahead of the curve on that really helped.

Guest (Sean Bowe): I think the other thing is that we were also ahead of the game on the AI for assurance. So we were attacking our own protocol very early on and eagerly with frontier AI models in order to find these really difficult to discover bugs that had eluded auditors and cryptographers and hackers for years. And there turned out to only be one of them. And it was very, very subtle that only an AI could really find, apparently. But because we were being really cautious, we were actually investing in things like that.

Guest (Sean Bowe): We're actually going to continue doing that. Like we think ahead, what are the threats and attacks that we might face in months from now, especially with AI because there's different kinds of threats, supply chain risks, which we can talk about. We need to think ahead and then be very clever about defenses.

Guest (Dev Ojha): What's kind of cool is formal verification is getting more and more capable every month. Like, literally today, one of my friends made a post after this whole PHP incident about how do you do formal verification off of the raw assembly to protect a PHP-like thing again. TLDR, this PHP thing depended on a memory management bug, which C code is very well known for having as an issue. And it's like, okay, here's a recipe to protect against this for everything for the rest of time. And here's proof we've done it at Anthropic, which was compile the code, formally verify off the real code, a bunch of memory safety properties really apply. I'm like, I think this is Anthropic in theorem cloud, whatever. Okay, cool, let's start doing that.

Guest (Dev Ojha): We formally verified the ZK stack. We fuzzed, or I say we, I didn't do it. This is all Sean and ZK security. We formally fuzzed the formal verification. Will it cover every known bug? Even if we injected a bug in the protocol, does it catch it? I think the next phase is going to be, hey, do the same methodology. It was just first time announced today for memory safety on assembly to every other type of bug that's possible in the raw full node itself. That compiled code could not have a database corruption. There's no way to corrupt the database with this compiled code.

Host (David Hoffman): So with all this formal verification stuff, there's a ton of auditing to do with regards to all the code. Like Dave just talked about all this fuzzing, which is a term I once knew but not really familiar. Why do we believe in this, in formal verification? What does this really do for Zcash in the fullness of time?

Guest (Sean Bowe): So you can formally verify things. What does it mean to formally verify something? It means that you have some kind of proof that some code or some math is correct according to some property or specification. And that's really vague because the specification can be wrong. The property you're actually checking could be wrong. The code or math that you're actually checking might not match what you actually shipped in your product. So you do need human beings to look at this stuff and make sure it is described correctly mathematically.

Guest (Sean Bowe): It's not that they have to read thousands of math theorems and look at hundreds of thousands of lines of proof, Lean code or proof code. They just have to look at the surface level and say, is this security property written correctly? And can I attack it? And so you need to have auditors looking at the formal verification process from that perspective.

Guest (Sean Bowe): What we did is we actually had a team called ZK Security go through. These people are experts at formal verification work. They went through and did two things. One, they did that analysis I just told you about. So instead of auditing the code necessarily, they're actually looking at the formal verification code. The second is that they actually deliberately went through, they have this huge repository of a thousand or so bugs that have been found in SNARK proofs over the years, inside circuits and inside of the actual protocols. And they went through all of them and found common threads and said, okay, we're going to try to inject these bugs into the code. Then we're going to go to the formal proofs and adjust them a little bit and find out if it says, no, you can't do that. It's not secure.

Guest (Sean Bowe): And they did it through all these and didn't find a single bug that they could inject into the code that would not actually surface at the layer of the formal verification. This is the kind of fuzzing that is being mentioned. So the security assurance is looking... and I don't think anybody's ever done that before. I think we're the first people to ever do something like that.

Host (David Hoffman): So you were poking at the ability for the formal verification to work in the first place. So you were, rather than just auditing Zcash itself, you were auditing the thing that was auditing Zcash.

Guest (Sean Bowe): Yeah, and also you were no longer looking for bugs in a sense because those are gone. You're looking for classes of bugs that would escape the analysis. You're looking for bugs that could have existed and would not have been caught. And so that's a level of security. It's like we're at a higher plane of auditing than just finding the actual bugs.

Guest (Dev Ojha): What's kind of insane is that this is pioneered. I think Zcash is the highest for cryptography. And now I think everyone's trying to extend the same methodology to every other bug known to man. It's like your raw binaries. I think that's just going to be what the security story of the whole planet is next two years.

Guest (Sean Bowe): We've already started doing this a little bit. Like recently, Dave actually came up with these crazy optimizations that sped up our cryptography. And we wanted to deploy it in Zcash. Well, we already had it all formally verified. The changes we had to make didn't actually change the protocol. They changed the way that the proofs were generated, how they were kept zero knowledge private, basically. And we didn't have a proof of that part of it because we didn't need it. We just needed a soundness proof for our system. But we have the whole protocol formally verified. So if we want to make a change, we can see if Dave's optimizations actually broke the scheme or not, broke privacy.

Guest (Sean Bowe): We could just take the existing thing we have formalized and immediately get a proof that it's zero knowledge. And then we can tweak the parts that we wanted to optimize and immediately see that it was just as secure, or at least quantify the exact security bounds on it. Which is also accelerating our ability to optimize things and feel confident doing so, which is cool too.

Host (David Hoffman): Super interesting. Dave, something you said earlier that I want you to touch on is multi-assumption. I'm not sure if that's ever a subject that we've talked about on Bankless. What is multi-assumption security as it relates to Zcash and what does it do for it?

Guest (Dev Ojha): Okay, so this one doesn't have consensus among people, but the idea is that there are a couple of different cryptographic vectors to go break Zcash or any blockchain in the world. And so your security is just going to be the weakest of the three. So let's take Zcash. If you break an elliptic curve, you've broken Zcash. If you can break Blake2B or SHA2, you'll have broken the pool. So what would it take to make it so that you don't have to break an elliptic curve or a hash, you have to break both in order to get any bad outcome?

Guest (Dev Ojha): So one day when Zcash goes to fully hash-based cryptography, which is kind of the most secure because you can't really do anything without depending on hashes. So let's say our hash is just SHA2 or Blake3. Well, then there's existential fear. Oh, what if Blake3 is broken? Are we fucked? So the natural response should be, what if we could do two hashes? What if we could use Blake3 and SHA2? And so if someone just broke Blake3, no big deal. Go update the protocol. Because you're fine as long as both aren't broken in a short period of time.

Guest (Dev Ojha): I think the end state of Zcash will look something like that. You've got to go break two assumptions, not just one, in whatever the final shielded pool is. Just because you very rarely have one. Getting a bug is very rare. That's kind of the point of this stuff. What's kind of cool is people have started this Hash Smash challenge for how do we break these hash functions. It's almost inspiring that all this AI progress has barely budged the frontier. But okay, we still want to be paranoid. Let's go add two of these. So that's what multi-assumption is.

Guest (Dev Ojha): I kind of think the final state of a lot of cryptography is going to end up being deployed such that you have to break two things and maybe raise what we currently call 128-bit soundness to like 140-bit or 160-bit just to account for the fact that we're exponentially growing the world's compute. And I think that's probably that state.

Host (David Hoffman): Okay, and this sounds very similar to a multi-client setup, where if one client breaks down, the other client holds fast and keeps the system up and running. And so it's not just enough to break one thing, you have to break both at the same time to actually attack the system. You said this doesn't have consensus with Zcash, so this is just like a Dave idea about long-term security and you still need to get Zcash consensus?

Guest (Dev Ojha): Call it a day by day. I'm really generous. I think a lot of people independently agree with it. But now there's a bunch of details when, how, and if.

Host (David Hoffman): Sure, the normal blockchain governance process.

Guest (Dev Ojha): Yeah, yeah, yeah. I think it's been... Sean probably day one of us first mentioned way, way before I got involved.

Guest (Sean Bowe): Oh, yeah. No, we were talking about it back before Zcash was launched. I think Zooko was a huge fan of doing multiple proofs covering the same transactions and just paying the cost of them being twice as large. But one of the proving systems could fail and the other one would basically save you. Which is morally equivalent to what Dave's talking about with the hashes, basically. It's been talked about.

Guest (Sean Bowe): I might be one of the ones that is kind of pessimistic about it because of how it interacts with scale and things like that. But my mind's open. First you've got to achieve scale.

Guest (Dev Ojha): I think that's also earlier. Like, so much of Zcash is hampered by the scale problem. I think people realize the issue of today the chain's max capacity is 2.9 TPS and the wallets would start choking. Or if you rewind 6 months ago, the wallets would be choking then. The next upgrade makes the capacity 6.5 TPS and we're worried about the wallets when they hit around 6 TPS fully used. When you're in that mentality, every unit of scale matters a ton. Anything that impedes it. When we're at the 50 to 100k TPS, we have a lot more flexibility to start doing stuff. Once we've broken the fundamental wallet tension and fundamental chain scaling tension.

[Music break]

Host (David Hoffman): I've been trading crypto for almost a decade. And I've used so many different wallets, exchanges, aggregators, or front ends. And I'm basically always looking for the same thing, just one interface with deep liquidity across a bunch of chains and assets where I can access markets like perps, earn yield, trade confidentially, and still control all of my funds. And I've never really found it. I'm just always switching wallets, juggling gas fees, or getting eaten by slippage. But near.com feels fundamentally different to me. I can do anything I want from any chain and keep all of my activity confidential. Crypto, tokenized assets, perps, payments. I can even earn yield confidentially. One account, over 30 chains, confidential by default. It's the way that crypto ought to work. And it's powered by Near, which has moved over $30 billion cross-chain, uses post-quantum signatures, and has run over five years on mainnet with zero downtime. Near.com is the best way to be on chain and be in control. Get 20% of your trading fees back on near.com using the bankless link in the show notes. Not investment advice.

[Music break]

Host (David Hoffman): Some exciting news. We are launching a new podcast to help people figure out the crypto cycle, how to navigate it. The best crypto cycle investor I know, his name is Michael Nadeau. He runs the DeFi Report. This is the guy that sent me a sell alert before the 1010 price drop happened. His cycle analysis has been absolutely on point. I've been following him for years. And this year, we started recording weekly podcast episodes. Each one, we get into his portfolio, what he's holding, the market structure, entry targets, fair market value of Bitcoin and Ether, and where we are in the cycle. There's new episodes that are released every Wednesday. They're 30 minutes, they're short, they're punchy. I think this crypto cycle is harder to navigate than most. So let's do it together. Go subscribe to this podcast. Search the DeFi Report wherever you get your podcasts, YouTube, Apple, Spotify, or find the link in the show notes. There's a new episode waiting for you now.

[Music break]

Host (David Hoffman): Guys, I think that wraps up the technical roadmap part of this podcast. I learned a lot. I really appreciate you guys spending the time and walking me through this. I want to kind of zoom back out and go back into the philosophy side of things, because my brain hurts and I think that's more fun anyways. Maybe we can kind of bang through some of these as we wrap this podcast up.

Host (David Hoffman): I want to talk about expressivity and Zcash. So Zcash has chosen to follow Bitcoin in a lot of its design philosophy to be pretty reductive, pretty simple, pretty narrow. As opposed to the Ethereum strategy to be expansive, complex, broad, general. Why is this the right choice for Zcash? And where is that line between Bitcoin and Ethereum that Zcash determines its correct place to be? And how does it determine that that's the place to be? Sean, I'll throw this one to you first.

Guest (Sean Bowe): Yeah, so I'm sure Dave has great thoughts on this as well. I personally think Zcash would be kind of screwed. Zcash would be cooked right now if we had added all these crazy features years ago. During, as you may know, Zcash for many years was not doing very well in the market. It had a pretty low price. And so there were a lot of people who were trying to just throw anything at the wall that they could. So during the DeFi revolution, everyone was talking about programmability. Private programmability sounds really cool for Zcash. So I was even co-authoring a paper that turned into a protocol that does that sort of stuff.

Guest (Sean Bowe): But then, for example, you have these things you've probably heard about, like ZSAs, Shielded Assets in Zcash. People were kind of thinking, oh, yeah, we'll jump in on the meme coin stuff and that'll get the price up or something like that. So there were lots of people trying to add these features. The problem is that we would be really screwed right now if we were trying to change the protocol to scale it, if we had those features, because then we'd have to accommodate them. And that would make the process way more complicated. It would make it really hard to secure it too.

Guest (Sean Bowe): All these features add tons of surface area of attacks and bugs. And especially in something like a zero-knowledge proof system, where one little bug in something that seems like it shouldn't matter can actually break the whole thing and screw everything up. And it isn't just isolated. One little part of it can break everything just because you have this feature. And so it would hurt our agility. And also, it's just difficult to architect a blockchain that can scale with all these features. We needed to solve payments. And so my focus for years has been, until we scale payments, we shouldn't even talk about all these other things. We should keep it simple.

Guest (Sean Bowe): Now, then we can talk. I think there's this growing movement inside of Zcash away from thinking about adding these kinds of features simply because we don't want to jeopardize the security of the project. So I think by the time we get to scaling payments, we probably are going to be a lot more conservative by then. But I don't know what Dave might think about it.

Guest (Dev Ojha): Yeah, I guess maybe there's two parts of what do I think is the expressivity you want. I think Zcash is missing two units of expression that have really hampered the rest of Bitcoin. One is, I think we want expressivity of custody methods. Today in Zcash, you just have this one private key and then in order to get a multisig you do an off-chain MPC to get a multisig. That's pretty cool but I think the world's kind of learned that we want a lot more out of this. You see the whole push for passkeys. The technical question is, how do you get secp256r1 instead of K1 support on the chain? That's a new custody thing that we should have expressivity for. But what's kind of cool is that you can imagine that's something that's uniquely enableable with recursion and some feature of Tachyon state.

Guest (Dev Ojha): The second point of featuredness I think you want in the end state is trustless client bridges between two chains. This is what really enables things like L2s or whatever. Things like, you want Zcash to change. You want Bitcoin to change. You're not succeeding. But okay, can you go do you want a theory or change? How can you make a minimal extension? So beyond those two, I don't really see anything else. And I don't even want to entertain those two, which I think matter most for payments, until we hit scale.

Guest (Dev Ojha): I'd probably be convinced that ZSA, or you could probably convince me that a meme coin is not a thing that should be blocked. I just think that it's crazy to put brain cells towards that when you're at a blockchain with 75-second blocks and three TPS. I want to be begging for no usage of anything but the core protocol in that certain world. When we're at a world of 50,000 TPS and like, please help us saturate this sub-second latencies, then it's a more interesting question. So until you hit that scaling path, I view anything but those two points of expressivity I point out as a distraction. And those two I only care about because I think they actually help accelerate that path. I think you can get a better, I think Near Intents could be even faster, even better UX to people if it had more trustless or better native custody.

Host (David Hoffman): What about the long-term security plan for Zcash? So as we've talked about, proof of work is the plan A for Zcash. It will remain the plan A for Zcash as far as I can tell. Zcash is also a 21 million hard cap supply. That also begs the question about, okay, how do we pay for the security budget in the fullness of time? So what pays for Zcash security in like 2100? What's the thought behind long-term Zcash security?

Guest (Dev Ojha): One is there's this thing called the NSM, or Network Sustainability Module, which the idea is that you collect a bunch of transaction fees now and allocate these transaction fees that you collect towards future miner emissions. So starting the next upgrade, 60% of transaction fees are not given to the miner. They're instead held by the protocol with the intention to start being distributed to miners under a similar halving schedule, but beginning four years from now. So the thesis is, while Zcash price is lower than the goal end state, start collecting this now that will help this future problem.

Host (David Hoffman): Is that the plan or is that just a proposed plan?

Guest (Dev Ojha): That is a merged plan that begins in two weeks. That is in the chain. That's happening. Yeah. Yep. That begins November 5th. And then the redistribution will happen in four years. I don't know the date off the top of my head. But the collection begins in two weeks.

Host (David Hoffman): Then there's a fair question of, is that sufficient? Is that, and scaling and market usage, sufficient to cover the long-term or not? That's a valid question. Do we have an answer to that question or is that just something to think about for the future?

Guest (Dev Ojha): Well, it's a similar thing to what's nice. Bitcoin's a bit of a canary here, right? So far, Bitcoin's hasn't been a problem for Bitcoin. And in fact, Bitcoin's had a worse problem with the DATs being incentivized to go acquire hash rate because that gives you public market memetics. And then it doesn't actually work. So all the miners have to shut off. And so you have a surplus of ASICs. Do I think it's going to work? I think so. I think the opex of it, or I think at the point where this becomes, if you're in the extreme success case, it's probably going to work. And then you're also able to start relying on altruism a little bit. Like, this is worth so much to people that they should just go run miners.

Host (David Hoffman): I think the most interesting thing to me is that if you go ask the Bitcoin community, the average person will just tell you, it's not a problem. Like, stop FUDing my coin. The security is going to be totally fine. And what I'm hearing from you guys is that we're keeping an eye on it and we are actually willing to make changes based off of data and reality. Right now, our focus is speed and scale. And at some point, security will get its place in line in terms of the priorities for Zcash. That's not today. We've already solved some amount of it with the collecting payments now to pay for security later. So there is some sort of admission that Zcash makes that Bitcoin doesn't, which is security is real and it's not a manifest destiny for Zcash to just be secure. But in terms of priorities today, it's not first or second. It's kind of what I'm hearing from you guys.

Guest (Dev Ojha): You can literally go query your LLM with Bitcoin that there is a day when it is zero satoshis given to miners. Like, I don't know, you can say that's not a problem.

Host (David Hoffman): Governance and coin voting. I'm kind of starting to turn this into a lightning round because I know I'm keeping you guys over our time. How does Zcash governance work? How do you have Zips, Zcash Improvement Proposals? How do they contrast to BIPs or EIPs in Ethereum land? Broadly, how does a change happen to Zcash?

Guest (Sean Bowe): So historically, there's been no written constitution for how the protocol has evolved. It's been basically people with some legitimacy, with some diversity amongst different organizations in Zcash that all happened to come to a consensus over what to do with no objections amongst vocal proponents of the project. So basically we just do whatever isn't controversial and has alignment amongst competing organizations in the project.

Guest (Sean Bowe): We have this thing called a ZIP process, which is a process essentially for specifying and coming to an agreement over what it means for the protocol to change and in what ways it changes. I think of that process as kind of ministerial in a sense. It's really valuable to have all this written out and described in detail. But it isn't the governance process. It's downstream of the governance process. And so we've been kind of lacking this actually coherent governance system.

Guest (Sean Bowe): Recently, over the last several years, especially over the last year or so, we've been going all in on coin holder voting. So coin holders have been able to voice their opinions on retroactive grants and things like that. In Zcash, we have this grant program and there's a lot of money, a lot of Zcash tokens or coins that are sitting in a pool that can be distributed to people who request it. And the coin holders vote on that. And this has only been improving and improving. And recently we had this $7 million or whatever it was coin holder retroactive grant vote, which is awesome. And we also had recently for the first time, or not for the first time, but I think in a significant way, we had this massive coin holder vote on what should we do with the next upgrade with NU7. And it received millions of ZEC participating, or I forget exactly how many, but it was a lot.

Guest (Sean Bowe): I think the direction we should move is if coin holders broadly agree with something, or rather if they disagree with something, we definitely shouldn't do it. That's my personal view. And so we're starting to actually have a coin holder-based governance system as time goes on, I believe, is sort of what's happening.

Host (David Hoffman): And it's not a formal vote, like it's not on-chain governance, it's a temp check. And I think the thing to pay attention to is how strong does that temp check actually change the future? Is that just a weak temp check or is that, oh no, ZEC holders really want this and that is very important to the broad weighting of all inputs?

Guest (Sean Bowe): I think it's really important for us to signal that it really matters what the ZEC holders think. It's an accountability mechanism for us as developers. They are the ZEC holders. They are the lifeblood of the project. But obviously, if ZEC holders did something ridiculous and voted for something that we would never do, that would violate our morals, of course we're not going to do it. But we should signal that. Like, for some reason, ZEC holders are voting for backdoor privacy to hand it off to the NSA. And for whatever reason, they wouldn't do that. They wouldn't do it. And it's ridiculous. But you wouldn't do it either. We wouldn't.

Guest (Dev Ojha): One thing kind of cool about Zcash is it's actually extremely decentralized at the development side as well. So there's a bunch of development orgs with a lot of say and stuff. So you want to solve this problem of, okay, they don't all agree or you work at the slowest person's preference. Well, one thing I think everyone will agree on is, if the coin holders are very opposed, like you're getting a bunch of people saying, we're going to go sell our ZEC, like 10, 20, 30% of supply if you do this. Well, okay, obviously you shouldn't do it. I don't think there's, if we're meritocratic and whose voice matters, it's hard to ever justify doing something that all coin holders are against.

Guest (Dev Ojha): I know there are other people like wallets, whatever, community members, people who build their stuff on top. But it's hard to distinguish importance even across felon orgs. Coin holders are the end state most neutral.

Host (David Hoffman): I know both of you can only speak for yourselves individually, but is the price of ZEC important? Is ZEC supposed to be a high price? Is that kind of one of the inputs as to why you guys are working on it? Obviously, privacy is important. Financial privacy is important. But is the price of ZEC, a high price of ZEC, one of the outcomes that both of you guys are working for?

Guest (Dev Ojha): I think it's a requirement in kind of like financial gain. It's a requirement to hit the dream of having thousands of payments per second. And okay, you want tens of thousands of payments per second. Well, you need tens of thousands of payments per second of demand. Okay, so you need, does that mean you need 100 million people holding it? Well, okay, if you have 100 million people holding it, do they need to have like $1,000 on average, et cetera?

Guest (Dev Ojha): And you start getting to, oh, you must have high market caps in order for this to like make any sense. You cannot coherently demand that this should be MasterCard Visa level TPS, 50K TPS, and think that a low market cap works. It doesn't make any sense.

Host (David Hoffman): Sean nodding in agreement.

Guest (Sean Bowe): Yeah, I think a high price acts as the flywheel of protocol evolution and defending the protocol, and succeeding. It just depends on it. I think historically, this has been evidenced by all the resources we have right now to develop and build things. It's massively higher than it was a couple years ago because of the exact price. And now there's a lot more built-in long-term treasuries in the community as well. So that has solidified and provided us with some confidence in the long-term vision of the project, which is necessary to make any progress.

Host (David Hoffman): If you wanted to take down Zcash, what would you do? So say it's your imaginary job to cause as much harm as possible to the project. You break encryption, halt the chain, whatever. Your goal is to do harm. What do you do?

Guest (Sean Bowe): This might get me in trouble later. Whatever I'm about to say, I think the greatest problem is stasis. How do you inject stasis? You make a bunch of committees. You know, the whole NSA playbook. So you attack the governance layer.

Guest (Dev Ojha): Yes.

Guest (Sean Bowe): And so you have a bunch of committees. You can only work, you can only proceed if the slowest member succeeds. And then, yeah, I think the way you'd, at the current stage, the greatest threat is takedown by slow committee.

Guest (Dev Ojha): I totally agree. So it's the Zcash governance that would be the place that if you wanted to stop the project, you would start interfering with governance.

Guest (Sean Bowe): Oh, yeah, I guess maybe two parts. Governance on the first, and monetary supply on the second, which is downstream of governance. Fuck up the governance, fuck with that. And then fuck with the ability to update. And fuck with the ability for governance to do updates that compromise core values.

Host (David Hoffman): Dave, Sean, this has been an absolute masterclass in Zcash. I really appreciate you guys coming on and teaching me and the Bankless Nation everything that we talked about here. Hopefully we can check in again about the progress in Zcash in a year or so. But as for now, I think this was everything I needed to know about the project. Thanks so much.

Guest (Sean Bowe): This was awesome. Thank you.

Guest (Dev Ojha): Great questions.

Host (David Hoffman): Bankless Nation, you guys know the deal. Crypto is risky. You can lose what you put in. This is the frontier. It's not for everyone, but we are glad you're with us on the Bankless Journey. Thanks a lot.