The Complete Zcash Roadmap | Sean Bowe and Dev Ojha

What would it take for private money to work at global scale? Zcash co-founder Sean Bowe and ZK researcher Dev join David Hoffman to unpack the next chapter of Zcash, from Tachyon's ambitious scaling roadmap to the challenge of building private wallets that actually work. --- 📣SPOTIFY PREMIUM RSS FEED | USE CODE: SPOTIFY24 https://bankless.cc/spotify-premium --- BANKLESS SPONSOR TOOLS: 🔓NEAR | TRADE CONFIDENTIALLY, GET 20% BACK https://bankless.cc/near2026 🌍 RIPIO | LOCAL CURRENCIES, ONCHAIN https://bankless.cc/ripio 🛡️VIZOR | THE WALLET ZCASH DEVS USE https://bankless.cc/vizor 🎯THE DEFI REPORT | ONCHAIN INSIGHTS https://thedefireport.io/bankless --- TIMESTAMPS 0:00 Why Zcash Matters Now 07:53 AI Makes Privacy Urgent 11:20 The Zcash Development Roadmap 17:33 Privacy Without Compromises 25:26 Scaling Zcash With Tachyon 39:42 Private Wallets and Proof of Work 41:06 Zcash's Quantum Defense Roadmap 1:00:53 AI Threats and Formal Verification 1:12:53 Security Through Multiple Assumptions 1:19:37 Why Payments Come First 1:25:54 Funding Proof-of-Work Security 1:29:34 Governance and Coinholder Voting 1:34:53 ZEC Price and Protocol Threats --- RESOURCES Sean Bowe https://x.com/ebfull Dev Ojha https://x.com/zkDragon --- Not financial or tax advice. See our investment disclosures here: https://www.bankless.com/disclosures

Speaker names marked ? are inferred from speaking time and the show’s known hosts — they are not voice-verified.

• 0:00Speaker 00

  Every time Zcash made a technical decision, the rest of the industry copied it. This was namely Ethereum.

• 0:04Speaker 01

  When you use a transparent ledger now, you should be actually really nervous.

• 0:08Speaker 00

  Do you have better anonymity in a system that has 1,000 payments per second? Or one payment a week? Obviously, 1,000 payments per second.

• 0:16David Hoffman?

  There's a difference between something being like 99.9% private and 100% private.

• 0:21Speaker 01

  We don't want to bend the knee on the privacy stuff. It would compromise our values.

• 0:27David Hoffman?

  What parts of Zcash are still quantum vulnerable today? And what's the plan for fixing it?

• 0:31Speaker 01

  There were three big pillars of this. The first one is quantum recoverability.

• 0:36Speaker 00

  There's this element of the Tachyon privacy design that was shippable today for near-intents. It's now shipped today in some wallets.

• 0:44David Hoffman?

  Yeah, I don't know who the whales are because it's private.

• 0:46Speaker 00

  Privacy gives you a lot. You cannot fish someone's wallet without a viewing key so easily.

• 0:50Speaker 01

  It really matters what the Zec holders think. Zec holders are the lifeblood of the project.

• 0:59David Hoffman?

  Bankless Station, I'm joined here with Sean Bo and Dave Ojha. Sean is a Zcash co-founder. He's been working in Zcash since 2015 and is the lead developer at Tachyon, which is an effort to overhaul how Zcash works, something we'll get into shortly. Sean, welcome to Bankless.

• 1:14Speaker 01

  Yeah, thanks for having me. It's awesome.

• 1:16David Hoffman?

  Dev is a longtime ZK researcher, co-founded Osmosis, the biggest DEX in the Cosmos ecosystem, now works on Zcash, trying to scale private transactions and quantum resistance. Also, something that we'll get into shortly. Dave, welcome to Bankless.

• 1:28Speaker 00

  Thanks for having me.

• 1:29David Hoffman?

  You two have come recommended to me as two of the smartest people in crypto who have both gotten nerd-sniped by Zcash. So maybe let's talk, let's start there. Why work on Zcash? Why is Zcash important to you? Sean, maybe I'll just start with you.

• 1:43Speaker 01

  Well, I've, yeah, I guess I was nerd-sniped like a decade ago. So I've been working on Zcash since the beginning.

• 1:51Speaker 01

  I was like a huge Bitcoin guy in my teenage years. And I always knew that Bitcoin had major privacy flaws that were going to be eventually fixed with cryptography. And so I wanted to make that a reality in Bitcoin and then gradually saw that that was never going to happen in Bitcoin. And then when a lot of interesting new cryptography papers came out, which actually made it possible for this to happen in blockchains in general, I was really excited about it. I was kind of waiting for it and I accidentally, accidentally got a job working on Zcash. So I was really lucky.

• 2:29Speaker 01

  And so I guess in the beginning, my obsession was with the cryptography. And I also have like a philosophical attachment to privacy, like a moral attachment to it.

• 2:44Speaker 01

  So that's important to me. So over the years, it's been fascinating that the cryptography has remained really interesting. Despite the fact that like in cryptography, like the fact that we can go a decade and there's still like new papers coming out every month and/or every couple of weeks that make things a little bit better or kind of surprise you a little bit is actually really exciting and awesome. So I really like the math, but also just the project has become incredibly important for privacy. For many years, it was the only real project in the entire blockchain world that was actually trying to do privacy and doing it at a great personal risk for some of our developers.

• 3:27Speaker 01

  There's always this like crushing threat of regulatory escalation, everything else. And so the fact that we kind of persevered through that and now we're doing really well, that's, that's also really exciting and awesome. And we're growing as a project. You know, people like Dave, for example, it's just, it's a really exciting time for Zcash.

• 3:51David Hoffman?

  Yeah, Dave, I'd love to hear from you as well about what motivates you to work on Zcash so strongly. Again, like I said, you guys have come highly recommended to me as people who are relentlessly mission-driven and zeroed in, locked in on Zcash and privacy. So Dave, what motivates you so hard?

• 4:10Speaker 00

  Yeah, um, I did join, what got me into cryptocurrency is like this is a space that's really worth assessing over was first actually learning that, oh, we can have, well, I did my first like, you know, bank check. I was like, what the fuck? If you just know these numbers, you can like strain my ballots. And then I was, and that's how I know cryptography. I'm like, we have this whole cryptography system. Oh, that's what Bitcoin's doing. Bitcoin's using digital signatures to go protect all this stuff. Well, okay, that's cool, except that you know my public identity. That's kind of crazy. I deeply care about privacy. So once I learned about Zcash, I was like, it's actually the first crypto coin I ever hold.

• 4:51Speaker 00

  This matters for solving privacy for the world. Then I learned about proof of stake and all these other problems for how we make blockchains usable, like IVC and Cosmos land. Like, okay, we need to have, in order for this to go anywhere, we need to start having chains to be able to communicate, et cetera.

• 5:08Speaker 00

  So I spent a lot of time like doing stark work with one of the Zcash like scientists, Sal Saadra Kheza, learned a ton from him. And then work on Tetherment to like, you know, scale proof of stake and make cross-chain communication happen impossible. It's like, I don't think stuff's going anywhere if you can't talk across chains. There's not going to have one monolith that solves it all. Well, and fast forward a few years, it's kind of DeFi summer. And we realized that, hey, one of the big problem, we have three big problems in crypto in 2020-ish, scaling, proof of stake is mostly solved, solved, and privacy. So I founded this, founded this chain. It's actually trying to tackle privacy for MEV.

• 5:52Speaker 00

  And the initial roadmap and goalpost is actually quite like phenomena of do, do private, private holding things and do threshold decryption to solve a bunch of like MEV risk. And then, you know, things start getting carried away, gets caught up in DeFi land. Turns out the whole privacy side roadmap was never really fulfilled on. But except that was the part that got me excited. That was like, well, I woke up every day to like work on the thing. Things then come last year. It's like, okay, we're going to repivot everything to fully privacy early last year.

• 6:27Speaker 00

  And then there's this big problem. How are you going to make a privacy system that like scales and goes anywhere? And I've always like followed, loved Zcash the whole time. First coin held, friends with many people from like the era four or five years ago. Oh, and all the research. I ended up meeting Sean and it's like, oh, whoa, okay. This is a concerted effort to like make this win and make this succeed. Let's, uh, let's join forces and like make it happen.

• 6:58Speaker 00

  So I think it's like the best shot we have for privacy winning. Also, I was really inspired by every time, every time Zcash made a technical decision, the rest of the industry copied it, even though when they're copying, if you're alert to what's going on, you'd obviously do something different. So it's like, okay, Zcash sets the way. This was namely Ethereum. When Ethereum was doing its first pairing stuff, Zcash has switched from one curve to Southern one called the 12381. Who cares? When Ethereum was going to go do stuff, they should have obviously done 12377. Now, and they didn't just because Zcash did. Oh, it's kind of inspiring. Then, uh, like, then you suddenly see a bunch of people start saying they care about privacy, who I was on calls with six months ago pitching stuff for like, well, where do we get?

• 7:43Speaker 00

  No, no one cares. No one, this will never matter. I was like, oh, wow. Okay, so Zcash succeeding is also inspiring for the rest of the world to care about privacy in a way that other things aren't.

• 7:53David Hoffman?

  Yeah, I don't think any Bankless listener is naive to why privacy is important. We've covered the topic of the importance of privacy a handful of times, probably primarily with Zuko, but a number of other guests. But I want to ask you guys about why privacy might be urgent in 2026. Cause if you ask me when I first got into crypto in 2017, be like, oh yeah, privacy is going to become a core pillar of the industry and we are all going to have financial privacy very quickly soon after proof of stake. And not only did proof of stake not really come very quickly, but neither did privacy, with the exception of in Zcash. So Sean, I'll ask you guys both this, but I'll start with you, Sean. Like what's your case for why privacy is urgent these days?

• 8:39Speaker 01

  Yeah, so, you know, it used to be that when you used a transparent blockchain ledger to transact, you know, if you're just a normal person, you weren't really worried about the fact that these, you know, chain analytics firms existed who could basically track everything that you do, associate all your transactions together, figure out your online activity based on that, for example, because you weren't really a real target. I was worried, but most like normal people weren't. And hackers and thieves were all.

• 9:12David Hoffman?

  You're not normal people.

• 9:13Speaker 01

  Right.

• 9:16Speaker 01

  So hackers and thieves were, you know, always really nervous and careful about using these things. But now with AI, obviously, a teenager just with access to an LLM, basically can, can identify and track everybody using these things. So everyone using crypto. So when you use a transparent ledger now, even if you're not a thief or a hacker or a criminal or any of that, you should be actually really nervous. So like in the coming years, I think it's going to get much worse. It's going to get so bad, in my view, that you will have these just public databases,

• 10:01Speaker 01

  these free public databases that will, that have completely mined the blockchain of information, where every single individual who's, who's been transacting on public ledgers has been quantified and tracked in every, in every possible way. And that, I think with this sort of AI resurgence, I think that's why privacy is like exploded. It didn't just like gradually get better. It kind of exploded over the last year. And, and that's why, because I think a lot of people paying attention actually realize that this is, this is serious. We need to get away from these transparent ledgers like right away.

• 10:36Speaker 00

  Yeah, the following problem is it's not just like your blockchain transactions. It's also every other data leak that in the world compounds like each Coinbase transaction exchange leak, oh, that's your address that gets tied to all this. It's not just like your physical address. It's not just like.

• 10:56Speaker 00

  There were the, there's one human in the world who has, uh, you know, this much of a bounce. So, uh, I, I think the problem's always been bad. It's just not many people had friends at Chainalysis or to see how bad it was. And now you don't need a friend. You go play, you just go type one sentence into your, uh, into Claude or just see the breach of the day to like, understand.

• 11:20David Hoffman?

  So in, uh, myself and also a lot of listeners probably are very familiar with Ethereum's like, um, swim lane roadmap. I'm wondering if there's something like that as scaffolding for knowledge for understanding the rest of the Zcash roadmap. Cause that's really what I'm looking to understand here with you two, having the opportunity to talk with you guys. How would you guys categorize the work left to do on Zcash? Like, well, what are the broad categories that all the work kind of fits into?

• 11:50Speaker 01

  Well, I'd be curious to see how Dave would categorize it, but I would, I guess there's in my mind, I think there's three camps or three like categories. There's, uh, there's the cryptography side. So there's trying to make the cryptography, um, more secure and more efficient. There's the, uh, there's the kind of the consensus protocol. So the networking side of things, making that scale.

• 12:18Speaker 01

  And then there's the wallet side of, of stuff. So making wallet scale and giving them good UX. I think those are, are probably, and Dave can, can speak to the last problem. And I think that's actually the most challenging problem.

• 12:31Speaker 01

  And he's actually, that's kind of why I'm really bullish on Zcash is because he's actually, uh, uh, most likely to, to solve those problems.

• 12:40Speaker 00

  I kind of think of it in high level goals of get scale, oh, um, harden the chain and then ensure full like economic sustainability. Where the latter is almost a minor detail, but I feel just like it's not one of the other two actually.

• 12:57Speaker 00

  Now, scale in my head encompasses several things, which is, uh, like, this is maybe a user face in my map of like, there's the three properties to expect. But to hit scale, you need a ton of stuff for wallets. And then you need, uh, a ton of like stuff in consensus, like make high, high throughput proof of work for the first time ever. And you need, uh, like cryptography advancements, like recursion, uh, and, uh, Tachyon and all sorts of like fee market updates, getting this into, uh, making an aggregated memple, et cetera. Then the second one is hardening is a bunch of privacy improvements, getting increasing security numbers, uh, bits of numbers, post-quantum, um,

• 13:40Speaker 00

  do you go multi-assumption, formal verification, uh, you know, five chains, et cetera. And the last one is like economics. Uh, well, today there's a bunch of services that you expect people to run for you. Like if you, if you take like Ethereum or a Solana wallet, RPCs are paid for by the wallet, like by phantom company or meta mass company. And they do some stuff to ensure you're not like spamming a bajillion wallets. And they expect to make money off you when you go swap one day. In Zcash, there, there's no tracking of the users. So then there's a couple of entities who provide these services for free for, um, requesting data.

• 14:21Speaker 00

  It turns out that, uh, in order to make Zcash scale, those guys have to do a lot more work over time. So, uh, but then we also don't want to have, uh, you know, them able to track you, uh, like, uh, so we want to have a way for the user to pay the RPC providers, but break any sort of tracking link. So we need to build some sort of private subscription service so that, uh, you know, we're not relying on altruism. Or what, uh, you know, I think the answer to the most altruism is that like, it ends up being a centralized foundation or nation states. So we don't want that. So user has to pay properly to get a proper market and have no identities. Uh, you can spitball some answers for us, but like, there's a difference for, it has to actually be deployed and real.

• 15:05David Hoffman?

  So as I'm kind of like learning about this, hearing you guys, a lot of this stuff feels very familiar to me. Like we need to scale the chain. We need to get over the quantum hurdle. The, the thing that feels uniquely different about Zcash is the relationship with the Zcash protocol and the wallets that use Zcash for privacy. That doesn't seem like it has any corollary to Ethereum or Bitcoin or any other project that I'm familiar with. Because, because, and I think it's the privacy variable that really makes this true. Whereas if you want to use a wallet while also maintaining privacy, there's just some extra, um, considerations that need to be made to preserve the notion of privacy.

• 15:46David Hoffman?

  And that creates new engineering challenges that is unique to Zcash. Is my understanding correct here?

• 15:52Speaker 00

  Yeah, absolutely. Um, I, I, I put it in two buckets as well. Scaling privacy for wallets is a fully unique challenge. And, uh, and actually it's actually harder than scaling a chain. And, and then, uh, scaling the, uh, and then yeah, how do you architect the chain to be more privacy aware? It's actually, I, I think that's a little bit easier of the two. Like actually the, one of the brilliant things of Tachyon is early in Zcash, these are really coupled. A lot of the things you need to be private, make the wallets private, uh, and wallet standards was baked into the protocol. The, one of the qualities of Tachyon was actually these get unbundled. And it's a lot of like, it just, I don't know how you, how you frame it, Sean, but in my head, it's like, we got, we learned how to make ZK way faster.

• 16:34Speaker 00

  So we didn't have to bundle these things for the last 5% of efficiency.

• 16:38Speaker 01

  Yeah, I, I think that we, we also bundled them for weird reasons. Like, for example, um, addresses, we, early on in Zcash, we were, we wanted the, uh, addresses to be as small as we could. And so, uh, certain keys that were in the addresses needed to be used both for the, the, the wallet facing side of the, uh, the stack. So for like the private transfers of information over the chain. And then the others, just for the custody and, and spend authority stuff. And, and so those got, uh, those got merged together just to make these addresses small. But of course now we live in a, uh, like in, in the kind of post-quantum world where the addresses are going to get really large.

• 17:23Speaker 01

  And so we need to solve that problem anyway. So it's kind of just, uh, it turned out to be pointless, uh, engineering architecture that we learned from that.

• 17:33David Hoffman?

  So I want to drill down into each of these, uh, three different categories. Both of you gave me three categories and while doing my best to make sure the layman can kind, you two are both very technical. I'm trying to do my best to get technical answers out of you that are still accessible to the layman. Before we start down those paths, though, those three different paths, are there any like overarching principles or philosophies that guide Zcash development broadly? Like something like in, in Bitcoin, for example, all Bitcoiners will say like, everything about Bitcoin is, uh, a means to an end to preserving 21 million units. That's an architectural philosophy that Bitcoiners have. Is there anything, is there any lesson like that in Zcash?

• 18:15David Hoffman?

  Sean, uh, I know you, you, you've used this phrase ledger indistinguishability before. Maybe that is something to talk about, but as developers who are writing code and as, as all cypherpunks know, code is imbued with values. How, what philosophy can you share as like, just like lessons for me and the listeners about how Zcash is built?

• 18:36Speaker 01

  So definitely the one philosophy that I think is ingrained throughout Zcash, if you wanted to pick one, is a kind of a maximalism on privacy. So, uh, in our shielded pools, we, we go as far as possible, uh, when it comes to privacy. And that's the thing that you were mentioning about ledger indistinguishability. So ledger indistinguishability is basically this academic term. Uh, so it's, it's, um, just a way to like, if you say that something's private, like say, say blockchain transactions are private. Was actually mean to say that, uh, like ledger indistinguishability is, is a way to quantify or, um, study that.

• 19:20Speaker 01

  So the way cryptographers do that is they kind of create this game where your adversary is trying to distinguish two transactions from one another. So, uh, they'll, you know, have a transaction from you and have one from Dave and want to tell them apart. And if they can, then it's, then it's game over. And so that's a, it's actually a really, really strong property because it means that the transactions have to look like just random data, basically in order to win that game. Uh, so all this privacy tech that exists in, in every project, uh, like stealth addresses and ring signatures and stuff like that, uh, throughout the crypto world. Those can help in certain situations, but, uh, fail that, that game easily.

• 20:06Speaker 01

  And so, uh, so we've kind of been really hardcore about making sure that, like, we've proven and now formally proven to some extent, this, uh, the, these security properties like ledger indistinguishability, uh, for these shielded pools, uh, that are in Zcash. Now, do we, is it like a hard and fast rule for Zcash? No, because we have transparent addresses and there's, there's other kinds of considerations. And so we do like, we take a, like a practical approach to it. But, um, uh, I guess the other part of that is that we also don't want to add any sort of concept of like a, a backdoor

• 20:49Speaker 01

  or, uh, any kind of like viewing capability for a regulator or any kind of, uh, anything like that. A lot of, uh, projects that have dabbled in privacy over the years have like, uh, entertained these goofy little, um,

• 21:05David Hoffman?

  Entertained bending the knee?

• 21:06Speaker 01

  Yeah, bending the knee. We, we don't want to bend the knee on, on the privacy, uh, stuff. Uh, we don't, we don't need to, we, it would compromise our, our, uh, our values. And so we don't even. Yeah, we don't even entertain it.

• 21:23David Hoffman?

  Yeah, I think that's what a lot of people get excited about Zcash about. Going back to the first thing you said, with like the ledger indistinguishability and just a full commitment to privacy.

• 21:34David Hoffman?

  Just to illustrate that point a little bit more, there's like a difference. I think what was something, another way to say what you were saying is like, there's a difference between something being like 99.9% private and 100% private. And if you go back and just look through the arms race between cryptography and cryptography breakers, like cipher, cryptanalysis, I believe is the word, is that the all weaknesses of any sort of cipher ever is that it leaves traces. It leaves, it leaves a trace somewhere. And if you leave enough traces, then somebody can Sudoku puzzle their way back into breaking the cryptography and the arms race continues. So maybe Sean, is maybe another way to what you were saying is that we're not going for 99% privacy.

• 22:19David Hoffman?

  We're going for 100% privacy.

• 22:20Speaker 01

  Yeah, that there in cryptography, there's always these known unknowns and unknown unknowns. When it comes to whether, if you leak a couple bits here, you can kind of just gesticulate, say, oh, well, whatever. It doesn't matter. We can't think of an attack. Cryptographers know better. They, they, they say, okay, well, that's probably going to come back and haunt us.

• 22:42Speaker 01

  Even if we can't think of an attack now, but actually in, when it comes to blockchain privacy, we actually know about all of the attacks or most of the attacks that you can perform. If you only have this like really good privacy, but not 100%. Like there are these attacks, for example, called set intersection attacks, where if you're trying to identify the source of money and you have somebody using a protocol, which anonymizes them amongst a, a large group of people, even a very large group of people in, in each transaction, then all you need is two transactions from your target in order to very quickly eliminate anyone except the actual target as being the source of those transactions.

• 23:27Speaker 01

  Simply because you, you leak way too, you leaking anything at all in one of the transactions immediately breaks everything in the other one. And we've known about this for a long time. Cryptographers have known about this. In fact, like this notion of ledger indistinguishability comes from like, I don't know, 12 years ago or something like that. In the Zero Cash paper, Zero Zero Coin paper, or whatever it came from, where they were actually trying to be more rigorous about what does it actually mean for an adversary to be able to break your privacy. You needed that in order to actually eliminate these kinds of set intersection attacks and stuff.

• 24:08Speaker 01

  So we actually know about the problems that are going to come back to haunt us, most of them, not all of them.

• 24:13David Hoffman?

  And knowing about them is the first step, I think, to just pruning them away from, from Zcash, which is what your job is, Sean, right? Yeah. Dev, Dave, anything to add about like the philosophy behind Zcash?

• 24:24Speaker 00

  Yeah, I, maybe I just restate a little bit simply of a

• 24:27David Hoffman?

  Yeah, please do.

• 24:28Speaker 00

  maximize privacy of don't take a shortcut. And so on the chain side, you went for the best known, the best you can get since day one. And now the principles only expand it further and further where, hey, it turned out the RPC side was always hard. So now we're bringing in solutions to keep improving that. So don't settle for any known, you know, distinguisher. Is a, I put one, pre-core one, another one is a, we inherit a bunch of Bitcoin, 21 million hard cap that shouldn't change. Proof of work.

• 25:02David Hoffman?

  Is proof of work built into the Zcash culture?

• 25:06Speaker 00

  Yeah, so there were some moves to push back and change it or add more to it. But I think it's like pretty solidified that the proof of work is, for the block wars is pretty central. I, I haven't seen any, and if you want to change it, you'd have to get miners on board and like coin holders on board.

• 25:26David Hoffman?

  Interesting. That's something that we'll go into the long-term security plan for Zcash towards the end. Let's get into to scale. Let's go into this first swim lane, scale and Tachyon. First, just again, at a high level, why is it important to scale Zcash at all? Like, why can't it just be like Bitcoin, which is to be a very decentralized, slow, constrained blockchain? Like, why doesn't that work, Sean?

• 25:47Speaker 01

  We need it to scale because, so like Bitcoin succeeded over the years because it got institutionally ingrained. Cause a lot of like millions of people started using it. And, you know, it would upset a lot of people if you did something to harm it. So it was sort of a foregone conclusion. We want Zcash, I think, I want Zcash to end up in that same position where just like as many people hold it as possible and use it as possible so that it becomes ingrained like this and becomes harder to attack. And so that's one reason. I mean, there's many reasons, but it, it needs to scale. The payment, the private payments need to scale in order to make that work at all. Otherwise people will just use some other tech.

• 26:32Speaker 01

  And that's really the simple answer for me.

• 26:36Speaker 01

  It, it's not going to succeed if people can't use it to transact. If people were just going to use it to, to hold it, they could do the, they could do something like that with Bitcoin.

• 26:49Speaker 00

  Yeah. Another way to think about it's like, do you have better anonymity in a system that has a thousand payments per second? Or one payment a week? Obviously a thousand payments per second. And so the limiting principle is, yeah, go get this to be as usable as cash.

• 27:05David Hoffman?

  So there's a one, two punch that I'm seeing here is that A, the job of being private is easier if more people are using it. The anonymity set there is larger, but also inside of Zcash philosophy, it's not just good enough to be a private store of value. It must also be a private way to do commerce too.

• 27:21Speaker 00

  One of the most inspiring moments I had when like meeting a lot of the like Zcash team members for the last 10 years is meet folks in some, some city, there's like this dinner bill to split of 11 people. And we have some very incredible people trying to like split this by hand and like calculate taxes, whatever. But then it was, that was a bit silly, but then it was this perfect peer-to-peer splitting using ZEC payments to each other. And like, and or ZEC OTCs to USD to pay. So, so, because there can be no credit card used and you have to use that with the ZEC wallets. But it was awesome. Like I've been, I've been going to crypto events, I don't know, 10 years now. I've never seen people like actually split up payments and using the real wallets at an event.

• 28:06Speaker 00

  Using this as like currencies actually in the culture, just kind of awesome.

• 28:11David Hoffman?

  That is cool. That is cool. And going into just like the human rights and individual rights like element. To me, this is like kind of encoding, hard coding and cryptography, the right to assembly, if you will. Because of these 11 people with this, this payment, had you guys used credit cards? Some authoritarian nation state could have said like, oh, look at you guys assembled, these 11 people assembled. And in this dark authoritarian imaginary world that I'm creating, that's not allowed according to this like oppressive nation state. And so removing the traces of data of people coordinating with each other and, and like grouping with each other, that's, that's the practical application here.

• 28:57David Hoffman?

  Let's get into Tachyon, which I think is the first step into the world of scale for scaling Zcash. Sean, how, how do you explain simply Tachyon, what it does and how it scales Zcash?

• 29:08Speaker 01

  So over the years, Zcash has had these different shielded pools. And like every few years, we've added a new one. And they've always like tried to improve something like the efficiency or, or add features or whatever. People, people kind of gravitate toward the most recent pool. We're like, the most recent one was Ironwood, which we watched earlier this year. And the reason to gravitate toward that is that was formally verified. The one before that Orchard was created because we wanted to remove the trusted setup. So we made it more secure in that sense. The one before that was Sapling, which we, which we made because the zero knowledge proofs.

• 29:51Speaker 01

  So we originally shipped in Zcash were really, really slow. And you couldn't even use it on phones. And so we needed to use like bleeding edge ZK tech in order to make it possible. So we've been making these incremental advances in the cryptography and that's what Tachyon is.

• 30:09Speaker 01

  Basically we're, we're tackling the last

• 30:14Speaker 01

  areas where the cryptography holds scale back. And there's a couple of places where it does this.

• 30:21Speaker 01

  So the, the first place is that, that proofs are large. And so if you want to put them in transactions, if you want to put more, more, more shielded transactions in a block, you have to deal with these zero knowledge proofs. I have to, you have to aggregate them. So like in Bitcoin today, we're having all these conversations about scaling Bitcoin in a post-quantum world, where you have post-quantum signatures that are much larger. So you have to think of how to, and that isn't Bitcoin, but in like Ethereum and everything else. So we're thinking, how do we aggregate the, the, these signatures together or these, these objects together? So that we can actually strip them out of the transaction and replace them with like a bigger one per block.

• 31:05Speaker 01

  That's basically what we're doing, except we have that problem, we have that scale problem already, even in the pre-quantum world. Where, and it applies to our zero knowledge proofs, not signatures, but zero knowledge proofs.

• 31:19Speaker 01

  And so Tachyon kind of addresses that and it uses this thing called a recursive snark to do it,

• 31:27Speaker 01

  which is this like fancy cryptography. And there's this other technical thing that doesn't scale very well in Zcash today, where basically every transaction that takes place, every shielded transaction adds or grows this set called the nullifier set, it grows it perpetually and you can't get rid of any of the data in it because you need it to prevent double spending.

• 31:53David Hoffman?

  Is this state bloof in the Ethereum world? This is state bloat?

• 31:58Speaker 01

  Yeah, so this is state bloat. Like in Bitcoin or Ethereum or whatever, you don't really have this problem because you can go back through and just remove the old data. I mean, you can keep the old chain data as like an archive node, of course, but the data you need to actually validate new transactions only has to sort of scale linearly with the number of users you have usually, something like that. In most transparent blockchains, but in ones like ours that take the privacy seriously, you're basically screwed a little bit. You need this set that grows perpetually. And Tachyon addresses that also

• 32:40Speaker 01

  with the recursive snarks. So we also use this cryptography to sort of compress these things. And we're basically tackling these two parts of the scale problem for the cryptography so that the remaining scaling challenges that exist in Zcash are, I don't want to say just engineering challenges because they're really daunting engineering challenges, but it becomes like the lower layer of Zcash, the cryptography is out of the way. We don't have to worry about that part of the architecture anymore. Everything above it is, needs to solve, the scaling challenges need to be solved above that, like on the consensus protocol

• 33:19Speaker 01

  or at the wallet, user-facing side of things. And that's like, you know, that's sort of the direction that we're going with Tachyon, enabling that.

• 33:29David Hoffman?

  Of the part of Zcash that Tachyon addresses, this isn't like block speeds or block sizes, which is like kind of the traditional thing to talk about when we talk about scaling. This is talking about reducing the size and therefore increasing the scale of the shielded transactions part of Zcash, is that correct?

• 33:49Speaker 01

  The actual cryptography, the private payment cryptography that takes place on chain, just falls apart with too many transactions, quite frankly. And so we need to fix that so that we can talk about, you know,

• 34:03David Hoffman?

  Increasing TPS.

• 34:05Speaker 01

  Massive blocks and massive TPS. Yeah, it's not even a conversation until we address those problems.

• 34:09David Hoffman?

  Right. Yeah. So the goal is high TPS, high big blocks. First, we need to solve some, there's some dominos earlier in the stack that allows us to have the resources to do the high TPS thing.

• 34:24Speaker 00

  Yeah, Tachyon on its own is a scale upgrade of, it changes the equation, if you're a full node, of today, let's say you want to process a million transactions on a block, you have to go verify a million ZKPs. With Tachyon, your job as a full node is now verify one ZKP. That's pretty cool. Second is that, oh, a million transactions would cause a million units of state forever. Okay, the state bloat is now gone with Tachyon. Now it's literally, if people are familiar with like a lot of the 2017, 2020 discussions of stateless blockchains, Zcash is like achieve what they're all talking about with stateless blockchain. You've got some state for the last like month or so in the live full node,

• 35:09Speaker 00

  and everything else is like the historic state that you can trustlessly query, need to go use, but it's not in the full node itself. So Tachyon brings both of these. And the first one is already like a 5X plus scale improvement, like on day one.

• 35:27David Hoffman?

  This is starting to remind me of like just ZK-ZK rollups in Ethereum land. You have a bunch of transactions, you roll them up once with a ZK circuit, and then you roll it up again with another ZK circuit, and you post the proof to the Ethereum layer one in the blob space. It sounds, the pattern sounds pretty similar. Is that about right?

• 35:44Speaker 00

  Yeah, credit to Ethereum for like doing a bunch on pioneering deployment of recursive ZKPs. It's the same thing, the same thing's going on for the first part. And the second part of going stateless is like a net new for the first time ever thing that Sean came up with.

• 36:01Speaker 01

  Yeah. So there was this paper that I wrote with Ian Myers last year where we detailed this technique that, I don't want to take all the credit for it, but where we detailed this technique that's kind of novel where you, that allows you to combine the recursive proofs with this other trick to make it possible to do this. So.

• 36:22David Hoffman?

  And then also with statelessness and just reducing the size of bloat, minimizing, eliminating the size of bloat on the ZK blockchain, doesn't that just also make it, the blockchain itself just more permeable across the internet in the sense that smaller devices can manage and take part in the ZK, in the Zcash blockchain? Is that right?

• 36:41Speaker 00

  Yeah, this depends what's your goal on, are you building a blockchain where you want a Raspberry Pi to be a full node? That, I think the Solana folks were actually entirely correct on this side of the trade-off of, if you want a Raspberry Pi, you're not getting scale. You're not going to be the, in Solana's case, you're not going to be decentralized NASDAQ. It doesn't make any sense. In Zcash's case, no, you can't, you can't shut the ZK TPS through Raspberry Pi, even if you want it. Because at some limit, there is like a bandwidth problem. Like, how much can you process in a Raspberry Pi? 10 megs, 100 megs, et cetera. But it does drop the requirement of, okay, maybe you don't need a, you don't

• 37:24Speaker 00

  need a petabyte of SSD, you just need a couple hundred megs, a couple hundred gigs SSD. So Zcash isn't on the side of the spectrum of Raspberry Pi full nodes. I think everyone's on board with like, look, you want to be a payment system that's not going to work, but okay, let's do a bunch to maximize it under like being reasonable.

• 37:44David Hoffman?

  Dollar stablecoins taught Latin America how to store value on chain. Ripio is taking that same idea and bringing it to the currencies people actually use every day. With wrapped fiat, Ripio is putting more than a decade of experience powering crypto infrastructure for leading companies across Latin America behind a suite of six local currency stablecoins, covering Argentina, Brazil, Mexico, Colombia, Chile, and Peru. Each is pegged one-to-one to its local currency and fully backed by reserves held in regulated financial institutions with independent attestations published for each token. But wrapped fiat is not just designed to sit there, it's built to move. The suite is live across 10 EVM chains with liquidity and integrations already spanning platforms like Morpho, Uniswap, and Chainlink. Users can move between local payment rails like Pick's and Spey and matching wrapped

• 38:27David Hoffman?

  fiat one-to-one in real time with zero fees on both on-ramps and off-ramps and no FX conversion. Local rails in, on-chain in the middle. And for builders, Ripio offers APIs, webhooks, widgets, and a sandbox just from day one. Start building with wrapped fiat today at platform.ripio.com. Your checking account isn't public, so why should your crypto be? As AI gets more powerful, your privacy gets weaker. Connecting your identity to your financial history on-chain or off is the easiest it's ever been and will only get easier from here. Every data breach adds another piece to the puzzle, and every public transaction leaves a trail back to you. And when your wealth is visible, you become a target. Money that can be seen can be stolen. Being in control of your money should include

• 39:08David Hoffman?

  controlling who sees what you do with it. Zcash fixes this. Zcash is private digital money with privacy enforced by zero-knowledge cryptography. Zcash shielded transactions let you send and spend without publicly revealing who you're paying or how much. When it comes to privacy, there is no second best. Get started with Zcash using Visor, the wallet Zcash devs and enthusiasts use to encrypt their money. Zcash wallets are non-trivial, and Visor goes the extra mile to make sure your money and privacy are fully protected. Open source, self-custodial, fully private. Use the link in the show notes to download Visor on mobile or desktop. Protect your future. Use Zcash. Is the Tachyon conversation the entire conversation around scaling around Zcash? Or what else is there that's not included in Tachyon with how to scale the blockchain?

• 39:51Speaker 00

  So Tachyon changes the cryptography side to make the scaling equation, as far as the blockchain's concerned, hey, every transaction's 2 kilobytes. Okay, you want 50,000 transactions per second, go build me a blockchain with 100 megabytes of throughput. So that, so then you have one whole new branch of how do you build a blockchain under proof of work that can achieve 100 megabytes per second throughput? Then you have a second part of the equation, which is unique to privacy, which is how do you build a private wallet that can discover when it gets paid without downloading all of data on the blockchain?

• 40:36Speaker 00

  I think what people, people often spend a lot of energy in trying to understand Zcash on how the zero-knowledge proof works, which is really cool. But the second question I think that people should understand, which is why has Zcash UX taken as long as it has to deliver or be usable, is the hard problem is how do you figure out you got paid? An anonymous payment is one where no one knows who it's from, who it's to, or how much is in it. So then, how can, your wallet can't go ask a server, hey, what's my balance?

• 41:10David Hoffman?

  Right, because it's a private blockchain. How does a wallet know if the blockchain is private?

• 41:16Speaker 00

  So the solution that's been done in Zcash up until very recently is you're going to go download every single transaction history and test, was this a transaction, a payment to me? Yes, no?

• 41:30Speaker 00

  But that can't scale. Because if the blockchain is doing 100 megs a second, you'd have to go download 100 megs a second. That doesn't work.

• 41:43Speaker 00

  So there's this really cool new line of cryptography that basically had a breakthrough 2024-ish. 2022-ish, but it's only really usable now. Called private information retrieval. And it's this huge work to say, to off, to say, instead of phone, go download, go download, it's called a terabyte of data. Instead, go do a query to a server. The server will operate over a terabyte of data and give you back an answer, but the server won't learn anything. This should feel a bit like FHE. Somehow I can encrypt some data, go talk to a server, or the server does some stuff on the data,

• 42:28Speaker 00

  gives you back an answer, and the answer is useful for me.

• 42:33Speaker 00

  And it should feel like FHE because it literally uses homorphous under the hood.

• 42:37David Hoffman?

  Because it is S H E.

• 42:39Speaker 00

  Yes.

• 42:42Speaker 00

  So it turns out for this precise use case, there were breakthroughs and tricks that makes it very fast to do on a server. It turns out you can transform this problem

• 42:53Speaker 00

  into just a big matrix vector multiplication. And it turns out that, hey, our friends in the AI world have made big matrix vector multiplications very cheap and usable for us. Just go have someone buy an H100 and go service for all of us. So these two things have come together. And the cryptography side invented this. And AI land has really optimized GPUs to make this a viable world.

• 43:21Speaker 00

  And so that's where we're going with the wallet side to make that scale.

• 43:24Speaker 01

  And Zcash has already deployed this PIR stuff. Like, we just had a coin holder vote where we used it for the first time, I think, in any cryptocurrency projects has ever used PIR. We used it

• 43:39Speaker 01

  less than a couple of months ago.

• 43:41David Hoffman?

  How does this not introduce a centralized third party? However, if we are querying a server, okay, I get that with FHE and the advancements in GPUs and processing power and all of that stuff, that I will be able to remain anonymous because that's what the math does. It keeps me anonymous. But nonetheless, I'm querying a centralized server. And so how does that not turn into a trusted intermediary that kind of arbitrates my relationship to Zcash?

• 44:09Speaker 00

  So there's two parts. One is like, kind of like RPCs, where, take Ethereum, right? You have to go talk to one RPC provider. Now, it's permissionless to go make a new RPC provider. Just go download a new copy of the chain and go index it yourself. And there's multiple providers already there. There's Alkamies, there's Infurys, et cetera. Apologies to like all the other dozen plus.

• 44:34David Hoffman?

  The ones that you're missing, yeah, sure.

• 44:38Speaker 00

  But there's a lot of options. So same thing as Zcash, there'll be a ton of options. And there should be a market incentive where you can like pay the providers. You have like anonymously. So you can obviously pay the providers that you can access it. And if there's, for some reason, you're being disenfranchised, whatever, there's not reachable one. Okay, go spin up a new node to the blockchain with admittedly a lot of bandwidth capacity. Sync it up and start serving.

• 45:06David Hoffman?

  Okay, okay. I would suppose that the paying of the Alchemy, the Infura, the RPC provider is also a privacy engineering challenge that is somewhat difficult, but I would assume thinks it's overcomable.

• 45:20Speaker 00

  Yeah, I can even sketch how you overcome it.

• 45:23David Hoffman?

  Sure.

• 45:24Speaker 00

  And the verbal sketch is basically, okay, in Zcash, we've got this trick for preventing double spends.

• 45:33Speaker 00

  If I want to go pay an RPC provider, I basically need to prove to you that when I go do a query, hey, I've got an active subscription to you. And my subscription has given me, let's call it 10 requests per second. And then, hey, look, I'm not using more than my 10 requests per second. So what I could do is I can make 10 one-time tokens for every like, every different second. And then, or maybe this would be more practical. Let's say I get 1,000 requests a month.

• 46:05Speaker 00

  So I can make 1,000 different one-time tokens. Every time I do a payment to you, I use the same technology I use for my private payments for proving no double spend to prove, hey, I'm using, I'm burning a new token each time. And it's a valid token that you, the server, have authorized. Now, you, the server, don't know,

• 46:27Speaker 00

  don't know which of your million users is using this subscription, but you can authenticate that, hey, it's a real subscription. The engineering problems, there's two engineering problems. One is how do you do this for the first time if you're onboarding user? Like, if I'm giving you your first sec, well, okay, you've got a wallet. You've got to go pay the wallet. So am I the one paying for your subscription? This looks a little, you can imagine a world that looks a little bit like Solana's state rent, if you're familiar or not, which is that every unit of state you have requires a minimum sol balance. You don't get deducted, but like, it must be some minimum. Maybe it's, you can imagine a world where we architect the wallet UX like that.

• 47:10Speaker 00

  The second problem is just that when you go to do it engineering-wise, hey, how, if I'm doing one payment, I might need to have done like 10 queries in the background. Okay, am I doing 10 Zcash-grade ZKPs in the background? That's kind of a lot? That's the verbal sketch I just gave. There's tons of engineering tricks to improve that. Just, look, someone's got to go dedicate a couple of months to like, bring that to reality. Which, great, there's a,

• 47:38Speaker 00

  that's a buy, that's a solvable problem.

• 47:40David Hoffman?

  Okay, so this is the two halves of Zcash scaling. There's the actual cryptography that's in the protocol on the blockchain that leans up the blockchain, makes it seem super sleek. I'm getting that image of the SpaceX engines. They start kind of complicated with wires everywhere. They end up pretty simple with very few moving parts. Kind of feels like that. Makes the Zcash blockchain, the cryptography, very efficient, very fast. That creates a problem. It makes the wallets need to be really smart with how they keep up with all of the data going through the blockchain. But that's what Dave said with the FHE on the server with the RPC that we just covered. You put those two things together and you have a very fast scaled Zcash.

• 48:23Speaker 00

  One more ingredient, which is scalable proof of work.

• 48:26David Hoffman?

  I was worried about that.

• 48:27Speaker 00

  Yeah. So it's three ingredients. You have two perfectly. The third one is just that Zcash is a blockchain today, processes about 60 kilobytes a second. In order to do 50k TPS with the glorious Tachyon feature, we need 100 megs a second. Okay, well, we're going to have to do a bunch of engineering stuff to go get us from 60 kilobytes to 100 megs. Well, step one is happening in like two weeks of just drop block times and keep the same block size. That, you know, the 3X is the bandwidth, so 60 kilobytes to 180. But then just do a lot more of that. Start erasure encoding blocks, just like everyone was talking about in 2017 and Solana does right now.

• 49:11Speaker 00

  And Ethereum does for the blobs, about the rest of it.

• 49:15Speaker 00

  Start doing that. Start just using more sophisticated gossip methods, similar to how Celestria does it as well for their fiber stuff. And you start seeing that, hey, 100 megabytes is actually really viable. There's one other problem, one other aspect to it, which is that proof of work block times are super variable. I don't know. I think a lot of people have really forgotten this problem since the ETH merge, which, when Zcash goes to a 25-second average block time, 1% of blocks are going to be super fast, 250 milliseconds, so 100x faster. And then 1% of blocks are going to be super slow, like over 110 seconds. So 4x slower than normal. So the trick is going to be,

• 50:00Speaker 00

  over the next two years, how do you, how do you maintain high throughput while keeping the security as the single-chain proof-of-work assumption that's like very familiar? And it turns out there's tons of tricks with all the different trade-offs. It's going to be, how do you pick which one is right for Zcash? Which is going to be like fun community discussions. That's going to be the direction you go. Like, it'll be a pretty straightforward kind of IMO, not really any trade-offs path to get to like. 1 to 10 megs per second of throughput. And then the 10 to 100 is going to be, okay, time to introduce a lot of something net novel and that we like. The whole community appreciates trade offs of us.

• 50:45Speaker 00

  But while remaining, single chain proof of work.

• 50:47David Hoffman?

  I'll admit, I never in my time in crypto did I ever think I'd be nerd sniped by something related to proof of work. That is a new hurdle for me.

• 50:57Speaker 00

  I think this whole block time variance thing is like we've all forgotten the pain since Ethereum moved off POW.

• 51:04David Hoffman?

  Right, right. Okay, let's wrap up scale and move into hardness because this is kind of like the other very big swim lane when it comes to Zcash. I think maybe we, let's start with quantum because that's the very sexy, very fun topic to talk about these days.

• 51:21David Hoffman?

  Broadly, what's the roadmap for Zcash to become post quantum? What parts of Zcash are still quantum vulnerable today? And what's the plan for fixing it?

• 51:29Speaker 01

  We did this video back in, I think, April or something where we outlined this kind of roadmap for post quantum cryptography in Zcash. And there were three big pillars of this. The first one is something that you've probably heard about if you follow Zcash discussions on social media. It was called quantum recoverability. And the idea behind this is do I have some money in the shielded pool? And then all of a sudden, quantum computers show up. Can I get my money out?

• 52:01Speaker 01

  That's, you know, can I recover my funds? And so if we add that to the protocol, it gives us like this buffer room or this like leg up over an attacker or like rapid advances in the cryptography, for example. And then it also allows us to feel more comfortable once enough people have moved into something that supports quantum recoverability that we can like kind of carefully and deliberately build more post quantum tech in Zcash. And people can gradually move over to that without worrying that, you know, people have to like mass migrate all of a sudden. Otherwise they're going to lose their money or something like that. So that's the first pillar and we've actually achieved this in Zcash.

• 52:46Speaker 01

  So we were talking about it in April. It's now live in Zcash as of a couple of months ago. And so if you have funds in a shielded wallet in Zcash, you probably have them inside of this new shielded pool, which supports this. So great. So that's one step in the right direction.

• 53:05David Hoffman?

  So that assets in the terminology of Justin Drake are in their bunker. The ZEC in the new shielded pool are inside of bunker mode.

• 53:16Speaker 01

  And we feel okay about that. You don't have to do anything. They're in the bunker, so to speak, but you can, yeah.

• 53:22Speaker 00

  Like today, today you could just go hide your wallet somewhere, come back 10 years later and you can spend it.

• 53:30Speaker 01

  Yeah, that's a simple explanation. Okay, so the second pillar is privacy. So right now, like Dave was saying earlier, if you want to receive money in Zcash, you basically scan the whole blockchain and try to figure out which payments are to you. And that's done using pre-quantum cryptography because it's quite small.

• 53:54Speaker 01

  And so we need to remove that and replace that with post quantum cryptography. And so doing that as part of the attack is one of the elements of the Tachyon shielded pool. So Tachyon is going to solve this too. So Tachyon is like you was alluding to earlier is decoupling the cryptography from what the wallets use so that the wallets can use post quantum key exchange stuff, like ML K and stuff.

• 54:25Speaker 01

  So after that's done, it's fully post quantum private. Now today, Zcash actually has some elements of post quantum privacy. So we have actually been thinking about this post quantum stuff for a very long time. The protocol, like certain adversaries and in certain situations, it's already post quantum private today. Like if you don't give your address out publicly, then your adversary can't de-anonymize or study your payments on chain. So if you keep your address private. But we're extending this to the whole thing. Another aspect that we've been sort of thinking about for a long time, actually, quantum recoverability. I believe we started building that as a community.

• 55:10Speaker 01

  Like the first specs were being written back in early 2025, I think. So that was a long time before everybody started panicking over quantum stuff. So we were working on this for quite some time. The last pillar is post quantum soundness. So basically, once you switch that over, the cryptography cannot be attacked at all by a quantum computer. And we're completely done. So today, a quantum computer could show up and counterfeit Zcash by attacking a shielded pool. Once it's post quantum sound, they can't do that at all.

• 55:50Speaker 01

  And those are basically the three areas that we need to, the roadmap.

• 55:56Speaker 00

  What's been kind of cool is that we discovered a bunch of intermediate ways to ship more of this since that like first April thing as well. So we got the quantum coverability fully through. On the privacy side, turns out there's been additional boosts. So the Zcash near intense integration now is actually 100% quantum unlinkable, which is like a new privacy step before we get to Tachyon. Where, sorry, it's quantum unlinkable and like supporting wallets who use some PIR features like ahead. But we can get that, we can get, well, what happened there was it turned out there's this element of the Tachyon privacy design that was shippable today for near intense.

• 56:39Speaker 00

  So great, it's now shipped today in some wallets. Similarly, on the post quantum soundness side. Okay, why is this harder for Zcash than every other chain? Well, we're going to have to go from these elliptic curve proofs to these post quantum recursive Starks. So lots of engineering work going on. Tachyon is, every time you achieve recursion, it's a very big deal. It's actually an incredible technical feat for Starks, like people should be proud of. So it's being done for the elliptic curves using like very clever tricks to make some of the most advanced achievements there for Tachyon. And we're to go adapt that to Starkland.

• 57:20Speaker 00

  But we can bring the post quantum pool, sorry, the transparent pool to being post quantum much earlier.

• 57:28Speaker 00

  Similarly, you could also ship, we can ship the quantum recoverability code in much earlier as well. So then what should look, what you should see is that, hey, early next year, you can now have fully post quantum transparent transactions. And maybe mid next year, you can demo, you can run the full path for like, hey, if a quantum computer appeared tomorrow, we freeze elliptic curves. You can see in real time that like, look, the chain will let you do it. You will go from a shielded pool to the, to post quantum transparent is there.

• 58:07Speaker 00

  So you, so if we freeze the chain for the curves, you still have access to funds as never lost. And then the final step of, okay, we've achieved the full post quantum recursive Stark pool.

• 58:21David Hoffman?

  So it sounds like there will be a moment where the entirety of the Zcash system is post quantum, but the path getting there is actually incremental rather than like specific or it's not one specific day. What are, maybe we could just trace over the actual big milestones for the big increments that happened between now and a fully post quantum Zcash. Like what are the big things that listeners should, the big flags that listeners should just know about that are coming down the pike for Zcash?

• 58:48Speaker 00

  I think the biggest one is that quantum coverability is live. So and then post quantum privacy should be fully live with Tachyon, like or Jan next year's.

• 58:57David Hoffman?

  So Tachyon is a very big milestone for Zcash in this step towards being post quantum.

• 59:03Speaker 00

  And to understand that, once you have post quantum privacy and quantum coverability, there's not that much to worry about, like some base level of trust of like, hey, the Zcash community, when they see a credible quantum threat that quantum's coming tomorrow, they'll proactively freeze elliptic curves. If you believe that link, then you have, there's kind of not anything to worry about. And a lot of the quantum paranoia, I think, comes from. A bit of not understanding how does attacking cryptography work in the world of, let's say you had a magic quantum computer in your pocket right now.

• 59:43Speaker 00

  You're not really going to be able to break every single key, every single thing right now. You'd have to have exclusive access to that and not leak anything to the rest of the world for a year plus. And then even more than that.

• 59:58David Hoffman?

  And then Zcash is probably not my first target. It's probably a little bit further down the line after I take Satoshi's coins and also hack all of China.

• 1:00:07Speaker 00

  Yeah, and with Zcash, one more thing on top of that is that you would also need, you don't have an easy access to know the balances. Are you just going to randomly check every address? Like, you can't just target the whales because you don't know the whale's address.

• 1:00:23David Hoffman?

  You're right. I don't know who the whales are because it's private, right?

• 1:00:26Speaker 00

  Yeah.

• 1:00:27David Hoffman?

  Right. So there's some level of bunkerness that Zcash has implicitly based off of the nature of what it is.

• 1:00:33Speaker 00

  Yeah, privacy gives you a lot, like, maybe this is a tangent, but a lot of these phishing attacks depend on knowing what transaction construct steal your funds. That on its own already needs a viewing key, which is hard to get in Zcash. Like, you cannot fish someone's wallet without a viewing key so easily.

• 1:00:53David Hoffman?

  So that's the quantum side of the equation. But we're also recording this right in the middle of like the internet apocalypse, like Black October. A couple of weeks ago, Justin Drake had that tweet about, hey, it's like it's time for bunker mode. And this wasn't because of quantum. This was actually just because AI models are getting so good that like more classical tricks are becoming valid for breaking systems. So what do we think about this? Just like AI math getting so competent that aside from quantum, it starts to poke at or threaten cryptographic systems like Zcash. Sean, does stuff like this work for you?

• 1:01:32Speaker 01

  I guess the thesis here was that was two things. One is that AI advances might attack classical crypto. And I haven't really seen a lot of examples of that. The other is that it might compound advances in

• 1:01:56Speaker 01

  like quantum computer development and things like that. So I think that was a lot of the worry was that, oh, this stuff is accelerating. So whatever concerns you had about switching to post quantum crypto before, you should probably be more worried now.

• 1:02:11Speaker 01

  I think that's like the generous takeaway from the bunker mode kind of panicked stuff.

• 1:02:19Speaker 01

  I think Ethereum is sort of hitched its like technical identity a little bit to some of this new cryptography.

• 1:02:29Speaker 01

  Because it resonates with the market and they've also, you know, and they've invested a lot into this stuff over the years. And like the cryptographers and engineers and stuff that have worked on it. So they have kind of a implicit like leadership position in that right now. And that can be abused a little bit because you can, I think that's a little bit what Justin's doing here is he's just kind of taking advantage of the fact that they have that kind of leadership role. And you can be more and more doomer and and try to like push the Overton window a little bit and kind of get away with it.

• 1:03:12Speaker 01

  Because the people on the other side are just like denying the threat entirely of AI or quantum computers and stuff like that. And they look silly. So I think, I think Justin probably ran into maybe the extent to which he can be a doomer without looking kind of ridiculous. That's just my personal view.

• 1:03:34David Hoffman?

  What about the subject of formal verification? Just to give Zcash just longer term, stronger, harder assurances about the hardness of the whole entire system.

• 1:03:43Speaker 01

  We have been working on, so with Tachyon, we were already writing, doing formal verification of Tachyon. Because Tachyon is actually kind of, it's using more esoteric cryptography. So like a year ago, we had already set up contracts with these like formal verification people to help us build this stuff and integrate it into our cryptography stack. And so we were already kind of ahead of the game on that. Then this orchid counterfeiting bug was discovered earlier this year. And so we needed to like basically rule out that it was impossible for any more counterfeiting bugs to exist. And you can do this with formal verification.

• 1:04:26Speaker 01

  Like, we can mathematically prove that there are no undetectable counterfeiting bugs in the protocol anymore inside of the shielded pool. And so we had this like massive month and a half long or two month long sprint to prove that, to formally verify it. And we pulled it off and shipped this upgrade. And I think it's like been hugely inspirational. I've heard from every project in the crypto world has messaged me and said, how are we going to do this for our protocol? What'd you guys do? How'd you guys do this so quickly? It really matters, especially if you're using this tech, even if you aren't.

• 1:05:10Speaker 01

  But especially if you're using this ZK tech, there's so many ways to screw up and the damage is incalculable. So us being ahead of the curve on that really helped. I think the other thing is that

• 1:05:26Speaker 01

  we were also ahead of the game on the AI for assurance. So like we were attacking our own protocol very early on and eagerly with like frontier AI models in order to find these like really difficult to discover bugs that had eluded auditors and cryptographers and hackers for years. And there turned out to only be one of them and it was very, very subtle that only an AI could really find, apparently. But because we were being really cautious, we were actually investing in things like that. And so we should, we're actually going to continue doing that.

• 1:06:11Speaker 01

  Like, we think ahead, like, what are the threats and attacks that we might face in months from now? Especially with AI, because there's different kinds of threats, supply chain risks, which we can talk about.

• 1:06:24Speaker 01

  We need to think ahead and then like be very clever about defenses.

• 1:06:31Speaker 00

  What's kind of cool is formal verifications like getting more and more capable every month. Like literally today, one of my friends made a post after this whole PHP incident about how do you do formal verification off of the raw assembly to protect like a PHP like thing again? Where TLDR, this PHP thing depended on a memory management bug, which C code's like very well known for having as an issue. And it's like, okay, here's how, here is a recipe to protect against this for everything for the rest of time. And here's proof we've done it at Anthropic, which was compile the code, formally verify off the real code. A bunch of memory safety properties really apply to something like, I think this is Anthropic and Ethereum clap, whatever.

• 1:07:17Speaker 00

  Okay, cool. Let's start doing that. We formally verified the ZK stack. We fuzzed, or I say we, I didn't do it. This is all Sean and ZK Security.

• 1:07:29Speaker 00

  Formerly fuzzed the

• 1:07:34Speaker 00

  the highest form verification will cover every known bug, even if we like injected a bug in the protocol, does it catch it?

• 1:07:41Speaker 00

  I think the next phase is going to be, hey, do the same like methodology. It was just first time announced today for memory safety on assembly to like every other type of bug that's possible in the raw full node itself. That, hey, this compiled code could not have a, there's no way to corrupt the database, this compiled code.

• 1:08:01David Hoffman?

  So with all this formal verification stuff, there's just, there's a ton of auditing to do with regards to all the code. Like Dave just talked about all this fuzzing, which is a term I once knew, but not really familiar. Why do we believe in this, in formal verification? What does this really do for Zcash in the fullness of time?

• 1:08:20Speaker 01

  So like you can formally verify things. What does it mean to formally verify something? It means that you have some kind of proof that some. Code or some math is correct according to some property or specification. And that's really vague because the specification can be wrong. Like the, the, the property you're actually checking to be wrong. The code or math might add that you're actually checking might not match what you actually shipped in your, in your product. So you do need human beings to kind of look at this stuff and make sure that is it, is it described correctly mathematically?

• 1:09:00Speaker 01

  Like it's, it's not that they have to read thousands of math theorems and look at hundreds of thousands of lines of proof, lean code or proof code.

• 1:09:11Speaker 01

  They just have to look at the surface level and say, does this security, is this security property written correctly? And can I attack it? And so you need to have auditors sort of looking at the formal verification. Like from that perspective. And what we did is we actually had a team called ZK Security go through. These people are experts at formal verification work. They went through and did two things. They, one, they did that analysis I just told you about. So instead of auditing the code necessarily, they're actually looking at the formal verification code. The second is that they actually deliberately went through.

• 1:09:53Speaker 01

  They have this huge repository of like a thousand or something like that, like bugs that have been found in zero knowledge proofs over the years. Like inside of circuits and inside of the actual protocols and stuff. And they went through all of them and found like these common threads and said, okay, we're going to try to actually like inject these bugs into the code. Then we're going to go to the formal proofs and like adjust them a little bit and find out if it says, no, you can't do that. It's, it's not secure. And they did it through all these and didn't find a single bug that they could inject into the, into the code. That would, that would not actually surface at the layer of the formal verification, which is this kind of, this is the fuzzing that's being mentioned.

• 1:10:35Speaker 01

  Um, so the security assurance is looking, and I don't think anybody's ever done that before. I think we're the first people to ever do something like that. So security assurance.

• 1:10:44David Hoffman?

  You were poking at the ability for the formal verification to work in the first place. So you were like, rather than just auditing Zcash itself, you were auditing the thing that was auditing Zcash.

• 1:10:54Speaker 01

  Yeah. And also like you, you are no longer looking for bugs in a sense. Cause those are like gone. You're looking for classes of bugs that, that would escape the analysis. You're looking for bugs that could have existed, but, but, and, and would not have been caught. And so that's like a level of like.

• 1:11:17David Hoffman?

  It's like we're at a higher plane of auditing than just doing, finding the actual bugs.

• 1:11:23Speaker 00

  What's kind of insane is that, uh, this is like pioneered. I think it's, uh, Zcash is like the highest for cryptography. And now it's a, I think everyone's trying to extend the same methodology to every other bug known to man. Uh, and like your raw binaries. And I think that's just going to be what the security story of the whole planet is next two years.

• 1:11:42Speaker 01

  We, we've already started doing this a little bit, like recently, uh, Dave actually came up with these crazy optimizations that sped up our, our cryptography. And we wanted to deploy it in Zcash. Well, we already had it all formally verified. The, uh, changes we had to make didn't actually change the protocol. They changed the way that the proofs were generated, how they were kept, uh, zero knowledge private, basically. Um, and we didn't have a, a proof of that part of it because we didn't need it. We just needed a soundness proof for our system. Um, and, but we have the whole protocol formally verified. So if we wanted to make a change, we could see if Dave's optimizations actually broke the, the scheme or not, broke privacy.

• 1:12:24Speaker 01

  We could just basically take the existing thing we have formalized and immediately get a proof that it's zero knowledge. And then we can tweak the parts that we wanted to optimize and immediately see that it was just as efficient. Or, or sorry, just as secure or, or, or at least quantify the exact, uh, security bounds, uh, on, on it. Which is, that's like, it's also accelerating our ability to optimize things and feel confident doing so, which is cool too.

• 1:12:53David Hoffman?

  Super interesting, super interesting. Dave, something you said earlier that I, I want to, I want you to touch on is multi assumption. I'm not sure that's ever a subject that we've talked about on Bankless. What, what is multi assumption security as it releases Zcash and what does it do for it?

• 1:13:05Speaker 00

  Yeah. Okay. So the, this one doesn't have consensus among people, but the idea is that, hey, there's a couple of different cryptography vectors to go break Zcash. And, or anything, any, any box in the world. Um, and so your security is just going to be the weakest of the three. So let's take like iron. If you break an elliptic curve, you've broken, you've broken Zcash. If you can break, uh, Blake 2B or Shaw 2, you'll have, uh, broken the pool. Well, um, so we, uh, what would it take to make it so that, hey, it's not that you have to break an elliptic curve or, uh, uh, or a hash. You, you have to break both in order to get any bad outcome.

• 1:13:49Speaker 00

  So like, uh, my, my, one day when Zcash goes to fully hash based cryptography, just kind of the most secure. Because you can't really do anything without depending on hashes. Um, so then let's say our hash is just Shaw 2 or, or Blake 3. Well, then there's like essential fear of, oh, what if Blake 3 is broken and, uh, are, are we fucked? Um, so, well, okay, the, the natural response should be, what if we could do two hashes? What if you could be used like Blake 3 and Shaw 2? And so if someone just broke Blake 3, no big deal. Go update the protocol all, um, cause you're fine as long as both aren't broken in a short period of time.

• 1:14:31Speaker 00

  And so I think the end state is of Zcash will look something like that of, uh, hey, there's, you've got to go break two assumptions, not just one. And in like, whatever the final shielded pool is like, uh, when, when, just cause it's, you, you very rarely have, uh, one, getting a, uh, getting a, a bug is like very rare. That's kind of the point of the stuff. Uh, like what's kind of cool is people have started, uh, this like hash smash challenge for how do we break these hash functions? It's almost inspiring that all this AI progress has barely budged the, the frontier. But okay, we, we still want to be, you know, paranoid hats. Let's go add, uh, two of these.

• 1:15:16Speaker 00

  So that's what multi assumption is. I kind of think the final state of, uh, a lot of cryptography is going to end up being deploy such that you have to break two things. And maybe raises the, what we currently call 128 bit soundness to like 140 bit or 160 bit. Just to account for the fact that, hey, we're, we're exponentially going the world's compute. And I think that, yeah, it's probably that state.

• 1:15:39David Hoffman?

  Okay. And this sounds very similar to like a multi-client setup where if one client breaks down, the other client holds fast and keeps the system up and running. And so it's just, it's not just enough to break one thing. You have to break both at the same time to actually, uh, actually attack the system. You said this doesn't have consensus with Zcash. So this is just like a, a Dave idea about long-term security and you still need to get Zcash consensus.

• 1:16:02Speaker 00

  Call it a day, it is like pretty overly generous. I think a lot of people independently agree with, uh, agree with it. But now there's a bunch of details, when, how, and if, so.

• 1:16:12David Hoffman?

  Sure. The normal blockchain governance process.

• 1:16:14Speaker 00

  Yeah. Yeah. Uh, I think it's been, Sean probably date one of the first mentioned way, way before I, uh.

• 1:16:21Speaker 01

  Oh yeah. No, we were talking about it back when, before Zcash was launched. Uh, I think Zuko was a huge fan of, of doing, uh, multi, having multiple proofs cover the same transactions. And just like paying the cost of them being like twice as large. But, uh, one of the previous systems could fail and the other one would basically save you. Um, which is morally equivalent to what Dave's talking about with the hashes, basically. Uh, it's been talked about. I think it, I, I'm not, I, I might be one of the ones that is kind of a, uh, like pessimistic about it because of how it interacts with scale and things like that. But, uh, you know, I'm, my mind's open.

• 1:17:04Speaker 00

  First, got to achieve scale. I think that's like also earlier, like so much of Zcash is hampered by the scale problem of, I think people realize the issue of today, the chain's max capacity is 2.9 TPS. And the wallets would start choking, uh, or rewind six months ago, wallets would be choking then. Um, next upgrade makes the capacity six and a half TPS. And we're worrying about, we're worried about the walls, uh, when they hit, they hit around six TPS, uh, fully used.

• 1:17:34Speaker 00

  Okay, well, first, when you're in that mentality, every like unit of scale matters ton, uh, anything like impedes. When we're at the 50 to 100 K TPS, we have a lot more flexibility to start doing stuff. Once we've broken the fundamental wallet tension and like fundamental chain scaling tension.

• 1:17:52David Hoffman?

  I've been trading crypto for almost a decade and I've used so many different wallets, exchanges, aggregators or front ends. And I'm basically always looking for the same thing, just one interface with a deep liquidity across a bunch of chains and assets where I can access markets like perps, earn yield, trade confidentially and still control all of my funds. And I've never really found it. And I'm just always switching wallets, juggling gas fees or getting eaten by slippage. But near.com feels fundamentally different to me. I can do anything I want from any chain and keep all of my activity confidential. Crypto, tokenized assets, perps, payments, I can even earn yield confidentially. One account over 30 chains confidential by default. It's the way that crypto ought to work and is powered by near, which has moved over $30 billion cross-chain, uses post-quantum

• 1:18:37David Hoffman?

  signatures and has run over five years on mainnet with zero downtime. Near.com is the best way to be on-chain and be in control. Get 20% of your trading fees back on near.com using the bankless link in the show notes, not investment advice.

• 1:18:49Ryan Sean Adams?

  Some exciting news. We are launching a new podcast to help people figure out the crypto cycle, how to navigate it. The best crypto cycle investor I know, his name is Michael Nato, he runs the DeFi Report. This is the guy that sent me a sell alert before the 1010 price drop happened. His cycle analysis has been absolutely on point. I've been following him for years and this year we started recording weekly podcast episodes. Each one, we get into his portfolio, what he's holding, the market structure, entry targets, fair market value of Bitcoin and Ether and where we are in the cycle. There's new episodes that are released every Wednesday. They're 30 minutes, they're short, they're punchy. I think this crypto cycle is harder to navigate than most, so let's do it together. Go subscribe to this podcast, search the DeFi Report wherever you get your podcasts, YouTube, Apple, Spotify,

• 1:19:34Ryan Sean Adams?

  or find a link in the show notes. There's a new episode waiting for you now.

• 1:19:37David Hoffman?

  Guys, I think that wraps up the technical roadmap part of this podcast. I learned a lot. I really appreciate you guys spending the time and walking me through this. I want to kind of zoom back out and go back into the philosophy side of things because my brain hurts and I think that's more fun anyways. Uh, maybe I can, we can kind of bang through some of these as we, as we wrap this podcast up. I want to talk about expressivity and Zcash. Uh, so like Zcash has chosen to follow Bitcoin in a lot of its design philosophy to be like pretty reductive, pretty simple, pretty narrow, as opposed to the Ethereum strategy to be expansive, complex, broad, general. Um, why is this the right choice

• 1:20:19David Hoffman?

  for Zcash? And where is that line between Bitcoin and Ethereum that Zcash determines its correct place to be? And how does it determine that that's the place to be? So Sean, I'll throw this one to you first.

• 1:20:34Speaker 01

  Uh, yeah. So I'm sure Dave has great thoughts on this as well. Um, but I personally think Zcash would be kind of screwed. Zcash should be like cooked right now if we had added all these crazy, uh, features years ago. Like during, as you may know, Zcash for many years was not doing very well in the market. It had pretty low price. And so there's a lot of people who were trying to just like throw anything at the wall that they could. Um, so during like the DeFi revolution, everyone was talking about programmability, private programmability sounds really cool for Zcash. Um, so you know, I was, I was

• 1:21:15Speaker 01

  even co-authoring, I even co-authored a paper that turned into a, uh, into a protocol that, uh, does that sort of stuff. Um, but, and for example, like you have these things you've probably heard about, like CSA's shielded assets, uh, in Zcash. People were kind of thinking, oh, yay, we'll, we'll jump in on the meme coin stuff and that'll get the price up or something like that. So there, there's lots of people that were trying to add these features. The problem is that, uh, we would be really screwed right now if we were trying to change the protocol to scale it. Uh, if we had those features, because then we'd

• 1:21:54Speaker 01

  have to accommodate them. Uh, and that would make the process way more complicated. It would make it really hard to secure it too. So all these features add tons of surface area of attacks and bugs. And especially in something like a zero launch proof system where one little bug in something that seems like it shouldn't matter can actually break the whole thing and screw everything up. And it doesn't, isn't just isolated to like once, one little part of it can break everything just because you have this feature. Uh, and so it would hurt our agility and also it's just difficult to architect a blockchain

• 1:22:34Speaker 01

  that can, uh, that can scale with all these features. We needed to solve payments. And so my focus for years has been until we scale payments, we shouldn't even talk about all these other things. Uh, we should keep it simple. Now, then we can talk, I think there's, there's this growing movement inside of Zcash away from thinking about adding these kinds of features simply because we don't want to jeopardize the security of the, the project. Uh, so I think by the time we get to around to scaling payments, we'd probably are gonna like be a lot more conservative, uh, by then. But I don't know what Dave might think about it.

• 1:23:11Speaker 00

  Uh, yeah, I guess maybe there's two parts of what do I think is the expressivity you want? I think Zcash is missing two units of expression, um, that have really hampered the rest of like, uh, Bitcoin. One is we, I think we want to expressivity of custody methods where today and Zcash just have this one private key and then in order to get a multi-sig, you do an off-chain MPC to get a multi-sig. That's pretty cool, but uh, I, I think the world's kind of learned that, hey, we want a lot more out of this. Like you see, uh, the whole push for pass keys is, okay, well, the second question

• 1:23:51Speaker 00

  is how do you get sec to P26R1 instead of K1 and, uh, support on the chain? Well, that's a new custody thing that we have, we should have expressivity for. But what was kind of cool is that, oh, you can imagine that's something that's uniquely enableable with like recursion and some feature attack on state. The second point of, um, the second point of like featuresness, I think you want in the end state is trustless, uh, like client bridges between two chains. So this is what like really enables things like L2s or whatever, things that like, hey, you want Zcash to change, you want Bitcoin to change, you're not, you're not succeeding. But okay, can you, can you go, all right, if you want to

• 1:24:35Speaker 00

  change, if there's not, I'll give you make a minimal extension. So beyond those two, I don't really, uh, see anything else. And I, I don't even want to entertain those two, which I think is matter most for payments until we hit scale. Like, so I, I'd probably be convinced that ZSA or like, you could probably convince me that, oh, hey, uh, a meme coin, uh, is not a thing that should be blocked. I just think that it's crazy to put brain cells towards that when you're at a blockchain with 75 second blocks and three TPS. I want to be begging for no usage of anything but the core protocol and that's

• 1:25:15Speaker 00

  our world. Okay. When we're at a world of 50,000 TPS and like, please help us saturate this, um, sub-second latencies. Okay. Then, then it's like a more interesting question. Uh, so yeah, until you hit that like scaling path, I view anything but, yeah, those two points of expressivity, I, uh, I point out as a distraction. So, and those two I only care about because I think they actually help accelerate a path. Like, I think you can get a better, I think near intense could be even faster, even better UX to people if it had more trustness or better native custody.

• 1:25:54David Hoffman?

  What about the long-term security plan for Zcash? So as we've talked about proof of work, is the plan A for Zcash will remain the plan A for Zcash as far as I can tell? Um, Zcash is also a 21 million hard cap supply. That also begs the question about, okay, how do we pay for the security budget in the fullness of time? So what pays for Zcash security in like 2100? What's the thought behind long-term Zcash security?

• 1:26:19Speaker 00

  One is there's a thing, uh, called the NSM or Network Sustainability Module, which the idea is that, hey, collect a bunch of transaction fees now and allocate these transaction fees that you collect towards future miner emissions. So, starting the next upgrade, 60% transaction fees are not given to the miner. They're instead held by the protocol with intention to start being distributed to miners, um, under like a similar halving schedule, but beginning four years from now. So the thesis is like, hey, while Zcash prices are lower, uh, than like the, the goal end state, uh, start collecting, collecting this now, that'll help, uh, help this future problem.

• 1:27:02David Hoffman?

  Is that, is that the plan? Or is that just a proposed plan?

• 1:27:05Speaker 00

  That is, that is a merged plan that like begins in two weeks and now.

• 1:27:11David Hoffman?

  Oh, that is in, that's in the, in the chain that's happening.

• 1:27:14Speaker 00

  Yeah. Uh, yep. That begins November 5th and then the redistribution will happen in like four years, 20, uh, whatever. I don't want to date offline, online, but, um, the collection begins two weeks. Uh, then there's a, there's a fair question of, is that sufficient? Or does that, is that going to cover, is that and scaling and like market usage sufficient to cover the long-term or, or not? That's a valid question.

• 1:27:40David Hoffman?

  Do we have an answer to that question? Or is that just something to think about for the future?

• 1:27:43Speaker 00

  Well, I mean, it's a similar thing to, what's nice is Bitcoin's a bit of a canary here, right? That so far Bitcoins, this hasn't been a problem for Bitcoin. And in fact, Bitcoins had a worse problem with like the Dats being incentivized to go acquire hash rate because that gives you, uh, I, uh, like public market memetics. And then, oh, it doesn't actually work. So all the miners have to like shut off. And so you have a surplus A6. Do I think it's going to work? I, I think so. I think like, um, I think the optics of it and, or I think at the point where this becomes, uh,

• 1:28:16Speaker 00

  If you're in the extreme success case, it's probably gonna work. And then you're also able to start relying on altruism a little bit of like, this is worth so much to people that like, they should just go run miners.

• 1:28:29David Hoffman?

  I think the most interesting thing to me is that if you go ask the Bitcoin community, the average person will just tell you, it's not a problem. Like, stop flooding my coin. The security is going to be totally fine. And what I'm hearing from you guys is that we're keeping an eye on it and we are actually willing to make changes based off of data and reality. Right now, our focus is speed and scale. And at some point, security will get its place in line in terms of the priorities for Zcash. That's not today. We've already solved some amount of it with the collecting payments now to pay for security later. So there is some sort of like admission that Zcash makes that Bitcoin doesn't,

• 1:29:14David Hoffman?

  which is, security is real and it's not a manifest destiny for Zcash to just be secure. But in terms of priorities today, it's not, it's not first or second. It's kind of what I'm hearing from you guys.

• 1:29:25Speaker 00

  You can literally go query your LLM with Bitcoin that there is a day when it is zero satoshis given to miners. Like, I don't know, you can say it's not a problem.

• 1:29:35David Hoffman?

  Governance and coin voting, I'm kind of starting to turn this into a lightning round because I know I'm keeping you guys over our time. How does Zcash governance work? How do you have ZIPS, Zcash improvement proposals? How do they contrast to BIPS or EIPs in Ethereum land? Broadly, how does a change happen to Zcash?

• 1:29:54Speaker 01

  So historically, we've had, it's been, there's no like written constitution for how the protocol has evolved. It's been basically people with some legitimacy, with some diverse diversity amongst different organizations in Zcash that all happened to come to a consensus over what to do with no, probably no objections amongst vocal proponents of the project. So basically, we just do whatever isn't controversial and has alignment amongst, you know, competing organizations in the project.

• 1:30:36Speaker 01

  We have this like thing called a zip process, which is a process essentially for specifying and coming to an agreement over what it means for the protocol to change and in what ways it changes. I think of that process as kind of ministerial in a sense. It's like really valuable to have all this written out and described in detail. But it isn't the governance process, like that governance, it's like downstream of the governance process. And so we've been kind of lacking this, like, actually coherent governance system.

• 1:31:17Speaker 01

  Recently, we've, over the last like several years, especially over the last year or so, we've been sort of like going all in on coin holder voting. So coin holders have been able to voice their opinions on like retroactive grants and things like that in Zcash. So we have this grant program and there's a lot of money that, a lot of Zcash tokens or coins that are sitting in a pool that can be distributed to people who request it. And the coin holders vote on that. And this has only been improving and improving. And then recently, we had this like $7 million or whatever it was, coin holder, retroactive grant vote, which is awesome.

• 1:32:02Speaker 01

  And we also had recently, for the first time, or it isn't for the first time, but I think in a significant way, we had this massive coin holder vote on what should we do with the next upgrade with N7? And it received millions of ZEC participating. Or I forget exactly how many, but it was a lot. And I think the, the direction we're moving, we should move, is if coin holders broadly agree with something, or rather, if they disagree with something, we definitely shouldn't do it. That's my personal view. And so we're starting to actually like have a coin holder based governance system

• 1:32:47Speaker 01

  as time goes on, I believe, is sort of what's happening.

• 1:32:50David Hoffman?

  And it's not a formal vote, like it's not on-chain governance. It's a temp check. And I think the thing to pay attention to is how strong does that temp check actually change the future? Is that just a weak temp check? Or is that, oh no, ZEC holders really want this? And that is very important to the broad weighting of all inputs.

• 1:33:11Speaker 01

  I think it's really important for us to signal that it really matters what the ZEC holders think. It's an accountability mechanism for us as developers. Like they are the, like ZEC holders are the lifeblood of the project. But it's like, obviously, if ZEC holders did something ridiculous and like voted for something that is like, that we would never do, that would violate our morals, like, of course, we're not gonna do it. But we should signal that.

• 1:33:40David Hoffman?

  Like backdoor, like for some reason, ZEC holders are voting for backdoor privacy to hand it off to the NSA.

• 1:33:45Speaker 01

  Right.

• 1:33:46David Hoffman?

  For whatever reason, they wouldn't do that.

• 1:33:48Speaker 01

  They wouldn't do it.

• 1:33:49David Hoffman?

  But you wouldn't do it either.

• 1:33:51Speaker 01

  We wouldn't, yeah, exactly.

• 1:33:52David Hoffman?

  Right.

• 1:33:54Speaker 00

  One thing kind of cool about Zcash is it's actually extremely decentralized at the development side as well. So there's a bunch of development orgs with a lot of say and stuff. So you want to solve this problem of like, okay, they don't all agree or you work at the slowest person's like preference. Well, one thing I think everyone will agree on is, hey, if the coin holders are very opposed, like you're getting a bunch of people saying, we're gonna go sell our ZEC of like 10, 20, 30% of supply if you do this. Oh, okay, obviously fucking shouldn't do it. Like, I don't think there's, if we're like meritocratic and whose voice matters, like it's hard to ever justify doing something that's all coin holders are against.

• 1:34:39Speaker 00

  So I know a bunch of people about like wallets, whatever, community members, people who build this stuff on top. But it's hard to distinguish importance, even across development orgs. Coin holders are the end state most neutral.

• 1:34:53David Hoffman?

  I know both of you can only speak for yourselves individually, but is the price of ZEC important? Is ZEC supposed to be a high price? Is that kind of one of the inputs as to why you guys are working on it? Obviously, privacy is important, financial privacy is important. But is the price of ZEC, a high price of ZEC, one of the outcomes that both of you guys are working for?

• 1:35:15Speaker 00

  I think it's a requirement in kind of like financial gain. It's a requirement to hit the dream of having thousands of payments per second. And okay, you want, you want 10,000 payments per second. Well, you need 10s of thousands of payments per second of demand. Okay, so you need, does that mean you need 100 million people holding it? Well, okay, if you need 100 million people holding it, do they need to have like 1,000 on average, et cetera? And you start getting to, oh, you must have high market caps in order for this to like make any sense. You cannot coherently demand, like, say, this should be, we should have Mastercard Visa level TPS and 50, so therefore 50k TPS

• 1:35:59Speaker 00

  and think that there's a low market cap works. It doesn't make any sense.

• 1:36:03David Hoffman?

  Sean, Sean nodding in agreement?

• 1:36:05Speaker 01

  Yeah, I think a high prices act is like, you know, the flywheel of protocol evolution and defending the protocol and succeeding. It just depends on it. I think historically, it has been evidenced by, you know, all the resources we have right now to develop and build things. It's like massively higher than it was a couple of years ago because of the ZEC price. And now there's a lot more built-in, long-term treasuries in the community as well. So like, that has solidified and provided us with like some confidence

• 1:36:46Speaker 01

  in the long-term vision of the project, which, which is, you need that to make any progress.

• 1:36:52David Hoffman?

  If you wanted to take down Zcash, what would you do? So say it's your imaginary job to just cause as much harm as possible to the project. You break encryption, halt the chain, whatever. You're just, your goal is to do harm. What do you do?

• 1:37:10Speaker 00

  This might get me in trouble later, whatever I'm about to say. Of, I think the greatest problem is stasis. How do you inject stasis? You make a bunch of committees and a bunch of, you know, the whole NSA playbook.

• 1:37:25David Hoffman?

  Okay, so you attack the governance layer.

• 1:37:27Speaker 00

  Yes. And so you have a bunch of committees, you can only work, you can only proceed if the slowest member succeeds. And then, yeah, I think the way you'd, at the current stage, the greatest threat is take down by slow committee.

• 1:37:44Speaker 01

  I totally agree.

• 1:37:46David Hoffman?

  So it's the Zcash governance that would be the place that if you wanted to stop the project, you would start fucking around with governance?

• 1:37:54Speaker 00

  Okay, I guess maybe two parts. I guess governance and the second is monetary supply, which is downstream governance. Okay, fuck up, fuck with this. And then fuck with the ability to update. And fuck with the ability for allowing governance to do maybe updates that compromise core values.

• 1:38:12David Hoffman?

  Dave, Sean, this has been an absolute masterclass in Zcash. I really appreciate you guys coming on and teaching me in the Bankless Nation everything that we talked about here. Hopefully, we can check in again about the progress in Zcash in a year or so. But as for now, I think this was everything I needed to know about the project.

• 1:38:28Speaker 01

  This was awesome. Thank you. Great questions.

• 1:38:31David Hoffman?

  Bankless Nation, you guys know the deal. Crypto is risky. You can lose what you put in. This is the frontier. It's not for everyone. But we are glad you're with us on the bankless journey. Thanks a lot.