Espresso | Privacy and Scalability for Web3

Hi, everyone. Welcome to Grey Matter, the podcast from Greylock, where we share stories from company builders and business leaders. I'm Seth Rosenberg, an investor at Greylock. Our guests today are Charles Liu and Benedict Bunz, who are part of the founding team of Espresso. Espresso is using zero knowledge proofs to solve privacy and scalability for Web3. The company just came out of stealth yesterday and Greylock is proud to be co leading espresso's 30 million Series A with our friends at Electric Capital. Charles Benedict, congratulations on the launch and thanks so much for joining me today.

Yeah, it's great to be on. Thanks for the invite, Svet.

Yeah, thanks for having us. Really excited about the launch and being on this podcast.

Yeah, this will be fun. So, just to kick it off, obviously, you know, it's just been an amazing time over the last several years to be working in Web3 and blockchain and you guys are both, you know, very early to this industry. Even, you know, with the quote unquote sell off over the last couple months, there's still just under $2 trillion of market cap in the industry and we've seen just an explosion of creativity from developers, you know, from payments to gaming to art and collectibles and defi. But it's obviously still extremely early innings, especially in terms of making crypto more mainstream. So just to kick it off, maybe if you could just share with the audience what is Espresso doing and give us an overview of the company.

Yeah, absolutely, Seth. You know, we've seen so many use cases for blockchain and web3 just explode over the last few years, and it's crazy to think back even just two or three years and realize that so much of what people are using and building today didn't even exist back in 2018 or even 2020. But like you said, it's still early innings. And with all these new use cases popping up, we're also seeing a lot of limitations with existing blockchain infrastructure. So with Espresso, we like to call it a single shot scaling privacy solution. And our goal is to bring low fees and flexible privacy to Web3 applications. Though scalability and privacy seem like orthogonal problems, it actually turns out that the same underlying technology which you mentioned, zero knowledge proofs, can actually be used to solve both of them. On the scalability side in particular, we're developing a high throughput transaction protocol that integrates rollups, ZK rollups with a decentralized proof of stake consensus protocol. And the goal is to be able to scale beyond hundreds of thousands of transactions per second, while still maintaining decentralization, including for the data availability problem. And on the privacy side, our goal is to enable what we call configurable privacy. So not just full transparency, like in most blockchain applications today, where anyone in the world can see all the data associated with an application, or full anonymity, like in zcash, but rather enabling a spectrum of possibilities depending on a particular application's needs.

Yeah, that's great. Thanks, Charles. And just for the audience, you know, there's going to be varying levels of familiarity with terms in blockchain. I want to circle back to, you know, this term zero knowledge proofs. So you guys are kind of leading researchers in this field from Stanford. You mentioned that it's a technique that can be useful for both scalability and privacy. Wondering if you could just spend a few moments just explaining to the audience who are maybe not PhDs in cryptography, what zero knowledge proof means and how they're deployed within espresso.

Yeah, so zero knowledge proofs are this really exciting technology that has actually existed since the late 80s, but it was kind of this, like, obscure cryptographic tool that we didn't even know. Like, it was at a level where, you know, for a long time, I think no one had. Like, we. There have been papers about zero knowledge proofs, but it's not clear that anybody had ever implemented really zero knowledge proofs because we didn't know how to do that very efficiently. But what zero knowledge probes allow you to do is that they allow you to show that something is true without revealing why it's true. So this seems a little bit paradoxical, but a classic example is I can prove to you that I know the solution to Sudoku without giving you the solution to the Sudoku or any information about the solution. And why is this important for privacy in blockchains? Well, if I encrypt my transaction, then no one can see, or only the sender and receiver can see the details of the transaction. So this gives me great privacy. But the fundamental issue is there is that it's not clear how people then check that the transaction is valid so that the sender, for example, had enough money to create the transaction. And for that, you need a zero knowledge proof so you can prove that the transaction is valid without revealing why it's valid. So, for example, without revealing the amounts that are being transferred or who the sender and receiver is. And that is the core value proposition of zero knowledge proofs. And the amazing thing is that in the recent years these, these tools have become more and more practical and now zero knowledge proofs are being deployed and are being used on blockchains. But so there's two properties to zero knowledge proofs. One is the privacy proof feature and then the other one is amazingly, these things also have a scalability feature and sometimes they're called also snarks. Zero knowledge proofs and ZK snarks. It's really the two names for, for kind of the same thing. But it turns out that it can create a proof for a large statement. So for example, I want to show to you that all of these transactions, like a million transactions in a block, all of them are valid. Well, it turns out that the size of the proof can be much, much smaller than the size of all of these transactions. So I can create a proof that is less than a kilobyte and everybody can verify this proof. And also checking that the proof is correct takes milliseconds. And still after checking this proof, you're convinced that all of these transactions are valid. And interestingly, the same techniques that give us privacy there can also give us scalability. So in the blockchain context, as I said, this can really be used to aggregate a bunch of transactions and then prove that all of these transactions are correct using such a zero knowledge proof. And yeah, it's been a super exciting time. This is, you know, it's a nascent technology but there's been so much progress even in the time during my PhD from like something that, yeah, I don't think was ever really used to something that is now being deployed on multiple blockchains is usable and there's a lot of research being done in this area and a lot of very, very exciting new developments.

So just a couple terms I'm going to throw out and can you maybe describe how espresso relates to these? So there's, you know, layer one, there's layer two and there's EVM compatibility.

What layer one and layer two mean. And these terms, you know, there's unfortunately in the blockchain space or there's a lot of terms that have a lot of different meanings and it's often helpful to step back a little bit. But what layer one and layer two really mean is, is whether this is an independent blockchain that runs its so called own consensus protocol. So whether there's a set of nodes there that agree on, say a set of transactions. So that would be a Layer 1 or Layer 2 is usually referred to as an application on top of another layer. One chain. And the most popular layer one blockchain is where there's Bitcoin. But Bitcoin just enabled simple transfers of value. And then came Ethereum, which enables much more complex smart contracts, which can be helpful for managing interaction between many different parties. So you can for example, build a full exchange, like a decentralized exchange on top of Ethereum. And these have been built and these are running where people can exchange money to each other without having a central party in the middle. So what Espresso is, is it's its own layer one blockchain. It runs its own consensus algorithm. We built a new consensus algorithm is obviously, as always, you know, there's a lot of beautiful ideas that have come out of academia in recent years. So we're trying to incorporate some of the ideas there. But still we want to be part of the Ethereum ecosystem and there's really two ways in which we do that. So first of all we're building a blockchain that is so called EVM compatible. That means that if you write a smart contract for Ethereum, you can also deploy the same smart contract, the same code that you wrote on top of Espresso. And the second important layer is what is called a bridge. So bridges have become very popular because they enable you to move assets from one blockchain to another blockchain. So you can, for example, create some stablecoin, some circle based stablecoin is created on Ethereum and then you can move it over to Espresso, transfer it there for very low fees and then move it back to Ethereum so you, you can really view. Even though Espresso is a layer one solution, it can really be viewed as also a privacy and scalability solution for existing blockchains like Ethereum because these bridges enable the connectivity between these blockchains.

Yeah, that's super helpful and it's really exciting, right? For anyone who's tried to buy NFTs on Ethereum and had to deal with hundreds of dollars of gas fees and transaction fees, I think the industry is definitely excited and ready for something like Espresso that brings scalability to blockchain. And I think privacy, especially configurable privacy, is maybe less talked about today, but I think people are going to realize how important it is going forward. I want to just double click on privacy for a second. Casual observers of the space, especially early on, there are a lot of memes about Bitcoin being used for illicit transactions. Like Bitcoin is a way to buy drugs online. I think in reality, as you mentioned cryptocurrencies as they exist today. Every single transaction is available on a public ledger. Right. So in many ways it's kind of the worst technology that you could use if you're trying to hide a transaction. Tell us more about why privacy is important for different use cases and what the current state of privacy is for crypto.

There's this kind of common conception that Bitcoin is, is very private, but really what it is, is, is the kind of, the technical term is called pseudonymous that you can, you know, you can create a public key and that public key maybe doesn't say your name, it's, it's just a long string. But it turns out that really gives you the kind of worst trade off in terms of privacy. In that yes, maybe you can, you know, if you really try hard, there's some ways that you can at least temporarily pretend to be private. But if someone then has the tools, like say, someone you know, there's now companies that build tools that can then explicitly de. Anonymize people. And especially if, for example, you use your address twice, right. Then I know who you are, right. If you, if you, if I ever interact with you, then I know what your address is. And then I can just simply go to the blockchain and, and see all of the transactions in the past and I can even see the amounts and you know, exactly infer things from that. Like it really seems to be a bad term trade off in terms of privacy. And there are now blockchains out there that give you kind of full privacy, like Monero and zcash are famous examples of that. And you know, certainly they have use cases even outside of illicit activities. You know, if you, if there's oppressive governments and you know, it's important to have this level of privacy there, but they're really very limited in their privacy option. They only give you full privacy. So we really have an option. We have something like Bitcoin and Ethereum which has no privacy, and we have Monero and zcash which has full privacy. But most people don't really fall into either of these buckets, right? They want the similar level of privacy or they want to say similar, same level of privacy that you have for your bank transfers, where maybe your bank can see them, but certainly not the general public, not your ex partner can see all of the transactions and what you've been doing. So we really think that there's a need there for, as Charles was saying, configurable privacy where for example, you can transfer money but under certain conditions there is a view key that someone can use in order to say that say we have a stable stablecoin which is a digital version of a dollar and say the issue of that stablecoin under certain conditions can use the view key in order to de anonymize the transaction if they need to. But it's always public. It has always perfect privacy. It has always perfect privacy towards the general public.

Yeah, that's fascinating. Thanks for walking us through that. So I would love to hear just, or maybe tell the audience a little bit more about your backgrounds and then how you also met Ben Fish and Jill Gunter and how you all decided to work on this specific problem together.

I'm finishing up my PhD actually at Stanford University in cryptography. So cryptography is the science of encryption and is really the underlying technology behind blockchains and cryptocurrencies. And I think I'm one of the first PhD students that really came into cryptography from, you know, previously being excited about blockchains. I think this is. Cryptography is an old science that is being used to secure our Internet and our financial, traditional financial transactions every day. And that is where I first met Ben Fish, who's also a PhD student. There were both PhD students with Dan Bonet and we worked on a lot of different cryptography protocols and especially zero knowledge proofs and wrote many papers together. But one of the amazing things is that also these technologies now are being going from academia and being deployed into practice. And then also we met Charles there who started his PhD and we decided that kind of the time was right. And then we started Espresso. Then shortly after we knew Jill from, from conferences and we were really excited about getting her to join. And she really has, you know, we really have the same kind of view and the vision where I think all of us like what one of the things that unites us outside of the technical knowledge is that we really want to build something that is useful and that is going to get used and really have an focus there on not just the technology, even though that's where we maybe come from, but really on trying to build something for important use cases.

So Charles, I'm curious, walk me through the moment you decided to finally pull the trigger and start the company and what you guys have accomplished since then.

I was very passionate about blockchains and the technology. I started organizing the student group on campus called the Blockchain Club back when I was an undergrad. And now I believe it's one of the most popular organizations at at the school. And so therefore we had the chance to invite a lot of projects and founders and investors and people in the ecosystem in and we had the opportunity to see a bunch of the use cases that were being built. A lot of these use cases were very interesting and we saw the design space of applications grow and grow and grow. But fundamentally we saw a number of limitations. Being the limitations that you and Benedict have mentioned so far having this limited scalability and limited privacy options. Some applications like NFTs, we already saw them emerging many years ago, but they really only took off like last year. And they might not require as high of a level of privacy as payments, but there is this huge set of applications that still has not been unlocked yet, a massive design space that still awaits us out there that can really take advantage of the benefits that blockchains provide, such as decentralization, public auditability, censorship, resistance that has not yet been unlocked because of this lack of good scalability and this lack of configurable privacy. So for instance, take Defi for example. Defi. We've seen a ton of innovations over the last couple years. In fact, back when we were still doing skill at Stanford, during that first class, I think MakerDAO had just came out as actually my favorite Defi product. It still remains my favorite Defi product. And last year, actually two years ago, we saw these new innovations like yield farming come out to kind of bootstrap an initial Defi network. We saw protocol owned liquidity and all these things. But one common thread is that Defi applications, generally speaking, they all require over collateralization. So if I'm trying to take a loan out on Compound or on MakerDAO, I generally need to lock up more collateral than the value of the loan I take out. So that's kind of like only having access to like a secured credit card. And it's, it's super limiting. And the reason for that is that there's no concept of credit, there's no concept of identity on chain. And it's really hard to imagine users being willing to put their personal identity information on chain for the whole world to see without having some privacy guarantees. And there's a lot of applications for which privacy is important, you know, like enterprise payments that still aren't really used on blockchains but have massive market size. You know, deal has actually been starting to work on enabling international payroll with cryptocurrency. But in the current state, you know, companies that want to pay their international employees or pay their suppliers only have two choices. As Benedict Mentioned one is to pay their employees or suppliers totally transparently on chain for the whole world to see, for their competitors to see. And the other is to use tools like zcash or Tornado Cash. And neither of those is really appealing. So one of the first products we've built at Espresso is a product called Cape Configurable Asset Privacy for Ethereum. And what we are doing there is actually bringing our technology to the Ethereum ecosystem. And what this allows users to do is to take their Ethereum assets, assets that are already issued on Ethereum such as Ethereum itself, Ether decentralized tokens like Dai, the decentralized stablecoin from MakerDAO or even centralized tokens like USDC or USDT and wrap them into a form that is private, such that transfers are private. They hide the sender and the recipient and the asset type and the amount, but still have auditability properties. So for instance, an asset issuer using Kape could set it such that they alone or a set of auditors could view transactions or even have other fine grained control over these applications or these assets. So that we're kind of bringing it from a sort of Venmo where everyone's transaction is totally public to a version that is more in line with what users would expect, such as bank transfers where only a bank has access to your transaction history. So that is the first product we're releasing on Ethereum. It's live, the contracts are all open source now and we're really excited for the community to take a look. And that is the first step towards the larger vision which is Espresso to have our own highly scalable layer, one with very configurable privacy. Yeah, I love that.

Thanks Charles. I love the reference to secured credit card. I do find it fascinating just the amount of activity in DeFi which just shows the latent demand which I think has maybe blown past even like the most optimistic early people's expectations in cryptocurrency and blockchain that this amount of demand and transaction volume exists even with the problems that you mentioned. So I'm very excited to see, you know, what the type of creativity that Espresso can unlock.

Yeah, I think one of the things that I find exciting is, you know, you mentioned in the beginning I think the market cap being in the order of trillions of dollars and that is very exciting. But what is, I think to some degree even more exciting is really, you know, I think as we all mentioned is that now these use cases are emerging. So even like transfers of stablecoins, which are traditional currencies in digital forms. On blockchains, I think in 2021 I saw a statistic that they exceeded a trillion dollars. There's companies now using these for international payroll, and they're really using blockchain and these tools not for just for investment and speculation, but in order to enable better transfers. Because anybody who's tried to wire money internationally, they knows that that is in extreme pain. But still, this technology is so nascent and the fees are so high that I think there's just so much more room to grow there.

Yeah. So, Charles Benedict, I'm curious. Let's say I'm either a current computer science student or I'm an engineering manager at Stripe and I'm curious about Web3 and I want to start a company in Web3. Now I'm hearing that Espresso is launching a private and scalable layer, one that's backed by Greylock and Electric and Sequoia and many others. I'm curious, maybe I want to build on top of Espresso. So first of all, why would I do that? And then if I decide to build on top of Espresso, what are some of the most interesting applications I should think about?

Yeah, that's a great question. So, first of all, I think this is the case for many people right now. I think the cryptocurrency class at Stanford, the blockchain class at Stanford, has fluctuated in terms of enrollment, but it's consistently one of the biggest classes in the computer science department based on enrollment numbers. And it also fluctuates depending on the price of Bitcoin, I think is the joke. There are a lot of people in industry, we're hiring a lot of people who come from quote unquote, Web2 backgrounds that want to go into Web3. And I think one of the biggest skills is to learn solidity. A lot of chains starting with Ethereum are now solidity compatible. There's a big developer ecosystem, there's a lot of developer tools around the Ethereum ecosystem, and that is probably one of the fastest and most effective skills to learn to get into the web3 space in terms of the applications that we aim to support with Espresso and the most exciting types of applications. And by the way, we are also aiming to be solidity compatible, EVM compatible, so that applications built on Ethereum or using the EVM can also be deployed on Espresso with lower fees and with additional configurable privacy. We can divide types of applications into a few Categories. The first being infrastructure surrounding this new ecosystem that is being built for instance on ramps to convert fiat into blockchain assets. Taking real world assets and turning them into digital representations, you know, wallets for users to interact with blockchains and to explore the blockchain, understand what transactions are doing. All these things at the periphery that are really allowing to helping people onboard users. I think the second class of applications is bringing additional privacy to defi products that already exist on blockchains. So for instance, having a decentralized exchange that exists on the blockchain but with additional privacy, for instance, protecting the identities of the people trading but still complying with any compliance requirements that would require a certain party, such as a stablecoin issuer to know who is transacting in that asset. These are all things that will be enabled by Espresso. And then finally, I think there is a big class of applications that have not even been thought of yet. We're seeing a lot of new exciting games that take advantage of zero knowledge. Poker was a big thing in the last four or five years there have been a lot of efforts to try to build poker onto blockchains. But poker is kind of a game of incomplete information. You don't want people to see your cards. Obviously it's not like chess where everyone can see everything. And that is a big challenge to build on something like Ethereum that is completely transparent, but it's definitely going to be representative of the type of applications that can be built on Espresso. So there is going to be a big design space of applications that is unlocked by Espresso and we're excited to see what people build.

I love that we should host a World Series of Poker on Espresso and serve everyone coffee. Yeah. So Charles, I'm curious if you could just recap what you guys announced yesterday and what you have planned for the next six to 12 months.

Yeah, absolutely. We're super excited to launch, not just announcing the company but also releasing a lot of the the code bases and the products we've been building recently. I mentioned configurable asset privacy for Ethereum Cape, which is an application that is going to allow people to bring configurable privacy to existing assets on Ethereum. So imagining the first stablecoin where transactions are completely private but where assets still allow issuers to maintain the compliance and auditability requirements that they demand. So we have released those contracts Open source on GitHub. We're really excited for the community to take a look and we're also going to be deploying those contracts onto Ethereum Testnet and also releasing a GUI for users to interact with this application and start testing it out later this month. Concurrently with the release of Kape, we're also really excited to release a library called Jellyfish, which is a little lower in the stock stack. Jellyfish is a cryptographic library that we're releasing under the MIT license. So it's a very free license that is going to allow anyone to do really whatever they want with it. And we're really excited for these implementations of cryptographic primitives that we've done to be used throughout the ecosystem. Perhaps most exciting in the Jellyfish library that we've implemented is an implementation of Plunk, which is a popular zero knowledge proof system that people have been using recently. And we believe we have the most feature complete and efficient version of Plank. So really excited for developers to start building new and exciting applications with that. As for our roadmap for the next half year to a year, we're looking forward to releasing our Espresso layer one testnet later this year. That is going to contain many of the features of Kape, which is going to allow for configurably private asset transfers, but even more in terms of more flexible privacy for existing applications. That is of course going to also come with our highly scalable consensus integrating rollups and our proof of stake consensus protocol. And we're really excited for developers and users to try that.

That's awesome. Well, it's been so much fun having the opportunity to work with you guys for the last probably seven or eight months since we made the investment. And I'm excited to finally have Espresso out in the wild and get feedback from developers.

Yeah. At the same time, I mean, it's been amazing to have, you know, a team like Greylock behind us and supporting us and obviously you in particular, Seth. But we're really happy about our leads, Greylock and Electric. I mean, there's probably a lot of entrepreneurs listening to this and we specifically decided to go with a mainstream, you know, one of the biggest and best mainstream VCs like greylock and then also a blockchain VC like intellectric. And I think this combination is just such an amazing one, two punch of all the connections and the expertise that is there. And it's been a joy working with you.

Yeah, I definitely want to echo that. Greylock has been incredible in terms of the support that, you know, it's provided in terms of having just everything handled like recruiting, best practices, press, et cetera, has been super helpful. And on the other hand, Electric, a very crypto native fund, very in tune with the developers. They actually release an annual developer report. So just the combination of the two firms has been super helpful in helping us get Espresso to market. Definitely.

The pleasure is ours in terms of being able to work with you guys, and we're very excited for this next phase of Espresso. So yeah, thanks for joining and congrats again on the launch.

Thanks, Seth.

Thank you. That concludes this episode of Gray Matter. If you liked what you hear and want to find more interviews on entrepreneurship, Please subscribe at SoundCloud, Spotify, YouTube, or wherever you get your podcasts. You can also find all Gray Matter content at our website, greylock.com and you can follow us on Twitter reylockvc. Thanks for listening.