New layer 2 paper: NOCUST - A Securely Scalable Commit-Chain

[toowik]

NOCUST is a Commit-Chain or non-custodial side-chain to scale Blockchains through layer 2.

We are very excited to release today an updated version of the academic paper, adding passive delivery (recipients can now be offline), adding an experimental evaluation with gas costs etc, explaining in-depth the collateral requirements (for instant finality) and having a new way to perform provably consistent checkpoints with zkSNARKS (also experimentally evaluated).

The paper can be found here:
https://eprint.iacr.org/2018/642.pdf

Happy to discuss it.

[1713425992]

1713425992

[1713425992]

1713425992

[d5000]

This looks almost too good to be true, but thanks for sharing.

I've read until the "high level description". As I understand, the proposal consists of a "sidechain" created and operated by a centralized party, who commits regularly the state of the user accounts in the "sidechain" to the parent chain. The advantage to centralized sidechains, however, seems to be that if the centralized operator misbehaves, the users do not lose their holdings, but the operator has to exit. And the advantage with respect to LN is that, like in any sidechain, anyone can use the sidechain without having to do a transaction from the main chain.

At a first glance. it looks like a nice addition to LN - while it's not completely decentralized, it is superior to traditional centralized sidechains (like Elements or Rootstock) and also to totally centralized operators (like Coinbase). It looks also a little bit similar to Peter Todd's "treechain" idea.

Two layman questions:
1) Is the approach compatible with Bitcoin's UTXO-based structure? It looks that the paper talks about an "account-based chain" like NXT or Ethereum.
2) Won't the "checkpoints" sent by the Nocust operators occupy lots of blockchain space if there are many users?

[spartacusrex]

Cool! - but.. am I missing something ?

You have a smart contract where you send funds.

To withdraw funds from that smart contract you must show a valid merkle branch of hashes to the latest root commit, with your current balance.

A Commit Chain operator manages all the transaction between the users and posts the latest merkle root of all the account balances - in a hash tree - that all add up to the exact amount stored in the smart contract.   

..

What happens when the Operator correctly manipulates (you mention incorrect manipulation) the user account balances, and gives them all to his dummy account, without changing the overall supply.

Posts the new Chain root - then withdraws the lot ?

The smart contract does not check the full sequence of signed transactions that led to the current balances - just the merkle path of the account balances ?